SQL Injection Information Schema Enumeration - ATR-2026-01604 (cbb0a0f2-8fea-5d8a-906c-49eb2a019205)
Detects SQL injection payloads that query information_schema (or sqlite_master, pg_catalog, sys.tables) to enumerate table names, column names, and data types. Schema enumeration is the reconnaissance phase of SQL injection attacks—it reveals the database layout required to craft targeted UNION SELECT or DML payloads. Targeting agents that expose search/query tools backed by relational databases.