SQL Injection Information Schema Enumeration
An attacker sends specially crafted input to an AI agent that queries a relational database, trying to trick it into revealing the database's internal layout — table names, column names, and data types. This is reconnaissance: it tells the attacker where sensitive data lives before they try to steal or manipulate it.
How the attack works
The attacker submits a query or search request to an agent that has a database-backed search or query tool. The input contains SQL injection payloads that reference system catalogs like information_schema, sqlite_master, pg_catalog, or sys.tables. If the agent's tool passes this input through to the database without proper sanitization, the database returns schema metadata such as table and column names. The attacker uses this map of the database structure to craft follow-up attacks, typically UNION SELECT statements or data-modifying queries that target specific columns.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 9d64e690-d402-47fa-b483-cd57bff24a27
- Severity
- High
Why it matters
Successful enumeration hands an attacker the blueprint of the database, making follow-on data theft or tampering far more precise and effective. On its own this step does not extract customer data, but it is the setup for an attack that does.
What you can do
- →Use parameterized queries or prepared statements for every database call an agent makes; never build SQL from raw user input.
- →Restrict the database account used by the agent to only the tables and columns it actually needs, and deny access to information_schema, sqlite_master, pg_catalog, and sys.tables where possible.
- →Log and review queries containing references to system catalogs or schema metadata tables.
- →If you run schema documentation or ORM introspection tools, give them separate, clearly scoped credentials so their legitimate catalog access doesn't mask malicious enumeration.
Known benign look-alikes
- Database schema documentation agents with explicit catalog read permissions
- ORM introspection tools performing authorized schema discovery