Why is Blind SQL injection dangerous?

Question

PHP

Good day, dear toaster-inhabitants. Could you please explain how dangerous the
Blind SQL injection vulnerability is?
What can an attacker do with this?
I scanned my site and found this vulnerability. True, he did not give more detailed information, because the demo version.
An XSS vulnerability was also found using XSpider, and in

<input type="hidden" name="csrftoken" value="b1e0c4424e17c0d3410bf6c5f03cdf97">

. How XSS can work here, I can’t understand at all ... It also serves as protection against XSS attacks.

Answer 1

Blind only means that the result of the injection is not displayed on the page. At the same time, there are still methods that allow, if successful, to log in without knowing the password, for example, with this construction:
If the authorization request to the database looks like this:
then it is converted to
the result of the calculation will be TRUE for any user and password.
It is also possible to destroy the database itself by issuing the DROP TABLE or DROP DATABASE commands.

Answer 2

Thank you. All clear.

Answer 3

IMHO lies HSpider there is no such hole in Dzhang =)