Security researcher Josip Franjković discovered four SQL injection vulnerabilities across multiple Nokia domains (www4.nokia.de, a PHP site, and nokia.es subdomain), including blind SQL injection via User-Agent headers and time-based injection attacks, which Nokia's incident response team patched rapidly in April 2013. The researcher detailed advanced exploitation techniques such as using UNION-based subqueries with CASE statements to extract data from INSERT queries and bypass error-based detection.
A blind SQL injection vulnerability in a PostgreSQL LIMIT clause was exploited by using ASCII conversion to extract database information through response-based inference. The attacker created 127 albums and used nested `ascii(substr())` functions to convert extracted characters into numeric values that controlled the LIMIT clause row count, allowing information extraction by counting returned results.