Professional 1.6.27

Summary: Burp Suite 1.6.27, released 11 September 2015, added detection of completely blind SQL injection by sending payloads that make the database contact a Burp Collaborator server over DNS or HTTP. The payloads work against Oracle, Microsoft SQL Server, and MySQL on Windows, but PortSwigger said it had not found a similar technique for MySQL on Linux and offered swag to anyone who submitted a qualifying payload.
Why it matters: Blind SQL injection that produces no difference in an application's immediate response can now be confirmed through out-of-band DNS or HTTP callbacks, so an attacker needs only a database that can reach an external domain to prove the flaw exists.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026