Database Error Information Exposure

Detects database errors and query details sent directly to HTTP responses, leaking schema information.

zakirkun b44f9d3 2 files · 2.9 KB Updated

File contents

Database Error Information Exposure

Overview

Database error messages sent to users reveal internal schema details:

  • Table and column names
  • SQL query structure
  • Database version and type
  • Internal file paths (SQLite, PostgreSQL data directory)

This information directly assists attackers in crafting SQL injection payloads.

Remediation

Catch all database exceptions and return generic error messages. Log the actual error server-side.

zakirkun/ice-tea/tree/main/skills/database/db-error-exposure commit b44f9d3282

Frequently asked questions

npx skillmds@latest add zakirkun/database-error-information-exposure