A security researcher discovered a novel SQL injection extraction technique against Snowflake backends where standard error-based payloads were silently swallowed. The key insight: Snowflake processes queries in three phases (parsing, compilation, execution), and the vulnerable application only suppressed execution-phase errors while returning compilation errors verbatim. By exploiting Snowflake's compile-time constant folding behavior with SYSTEM$WAIT — which requires a constant numeric argument — the researcher forced the compiler to evaluate session functions like CURRENT_DATABASE() and CURRENT_USER() during compilation, embedding their values in the resulting compilation error message. This bypassed the application's error suppression entirely. The technique is bounded to session metadata (not table data), but still yields meaningful reconnaissance from an injection point that initially appeared unreadable. Mitigations include parameterized queries, input validation, suppressing all database errors from client responses, and query tagging for audit trails.
