SQL injection in URL path processing on www.ibm.com

Summary

A blind SQL injection in URL path processing on www.ibm.com was reported to IBM, analyzed and has been remediated. Thank you to @asterite.

Blind SQL injection was present in URL path processing on www.ibm.com. An interesting thing is that the vulnerability was present in, essentially, any path, one could put a single quote right after the leading slash in path to start exploiting it.

SQL query result was not reflected in server response and server response after exploitation attempt was always erroneous, but it differed depending on whether SQL query failed or not. If SQL query (influenced by our injection attack vector) did not fail, server responded with an endless redirect. If SQL query failed, server responded with status 500. So, it was possible to distinguish those two cases and use boolean error-based exfiltration technique.

Another complication was that spaces and line breaks (\n) could not be used in injected payload, but it was possible to overcome this and exploit the vulnerability without them.