Database Error Information Exposure
Overview
Database error messages sent to users reveal internal schema details:
- Table and column names
- SQL query structure
- Database version and type
- Internal file paths (SQLite, PostgreSQL data directory)
This information directly assists attackers in crafting SQL injection payloads.
Remediation
Catch all database exceptions and return generic error messages. Log the actual error server-side.