Blind SQL-injection signal in a public search surface
Blind conditions are still security-relevant when a reliable oracle exists. The engineering fix remains the same: remove dynamic query construction rather than trying to mask the symptom.
- Original severity
- P1 source-reported; not rescored by vulns.co
- Public source
- bugcrowd crowdstream
- Program / vendor
- National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
- Product / surface
- JPL Photojournal search
- Weakness
- Blind SQL injection · CWE-89
- Affected boundary
- Public search parameter processing
- Disclosure date
- 2025-04-11
- Public status checked
- 2026-09-10
- Public attribution
- MiguelSegoviaGil
What the evidence established
The disclosed report describes a timing-based inference signal rather than direct response-body extraction.
Why the impact was credible
The source reported that database information could be inferred through a blind query-injection condition.
Durable engineering lesson
Blind conditions are still security-relevant when a reliable oracle exists. The engineering fix remains the same: remove dynamic query construction rather than trying to mask the symptom.
Control pattern
Parameterize database calls, enforce strict input types, and make error and timing behavior non-informative where practical.
Primary public disclosure
Upstream availability and wording can change. Public status was last checked 2026-09-10.