Professional / Community 1.7.06
Summary: PortSwigger released Burp Suite Professional/Community 1.7.06 on 8 September 2016, adding a new scan check for second-order SQL injection vulnerabilities. When Burp observes stored user input being returned in a response, the scanner now runs its SQL injection detection logic with payloads supplied at the input submission point and evidence for a detected vulnerability at the input retrieval point, alongside fixes for a number of minor bugs.
Why it matters: Second-order SQL injection hides the attack at the point of submission and only surfaces where the stored data is later retrieved, so a scanner that tests only the input request would miss it entirely - this release moves detection to the retrieval point where the evidence actually appears.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026