A municipal app shows no verbose SQL errors, yet responses consistently change between true-looking and false-looking conditions for crafted inputs. How should that theme be classified?
Select an answer to reveal the explanation.
Short Explanation
No stack traces does not mean no SQLi. If the page quietly nods yes or no based on your crafted condition, that is boolean blind territory. Same injection family — just answered with behavior instead of error text.
Full Explanation
Blind SQL injection classes infer query outcomes from application behavior such as boolean response differences or timing, even without verbose database errors. Silence does not eliminate injection risk, and response differentials are not automatically XSS or CSRF. Controlled testing remains appropriate to confirm and document the class within scope. Assessors should recognize boolean/time-based blinds as legitimate SQLi themes requiring careful handling.