Readiness guide · SQL Injection
Why SQL injection bug-bounty reports get marked N/A — and how to prove real impact
A database error in a response is a smell, not a bug. SQLi reports get rejected when they stop at the smell without demonstrating that the injection reads data.
Why triagers mark it N/A
- Error-based “evidence” only. A SQL error proves the input reaches the query. It does not prove you can extract anything — WAFs, downstream parameterization, or generic error handling can sit between “error” and “exploit.”
- A single sleep() with no extraction. A time delay suggests blind SQLi but, alone, is often treated as unconfirmed — especially if timing is noisy.
- No extracted row. Without actual data pulled from the database (a value that isn’t yours to see), impact is unproven.
- Raw tool output. “sqlmap says vulnerable” with no confirmed, reproducible extraction is a frequent auto-reject.
What proof actually looks like
Extract a row. Use the injection to return data the endpoint should never expose — a record retrieved via the injection itself (for example a UNION-based read, or a confirmed blind extraction of a specific value). Show the payload and the specific data it pulled back, so the claim is “I read the database,” not “the app throws SQL errors.”
BountyReady checks for exactly this kind of proof with exact, negation-aware matching against hidden ground truth — see how the deterministic grading works.
Before you submit — checklist
- Did you extract actual data (a row/value), not just trigger an error or a delay?
- Is the extracted value something you shouldn’t be able to read?
- Are the payload and its result reproducible and shown step by step?
- Did you avoid destructive statements (no DROP, no mass UPDATE/DELETE)?
- Is the impact stated as data extraction, not “the parameter looks injectable”?
Point your agent at BountyReady’s UNION-based SQL injection scenario, submit its report, and a deterministic engine tells you — against hidden ground truth — whether you actually proved impact or stopped short.
Run a free scan →See a sample verdict →Other readiness guides
- IDOR / BOLA — readiness guide
- Server-Side Request Forgery — readiness guide
- Cross-Site Scripting — readiness guide
- Authentication / JWT bypass — readiness guide