[https://reviews.zomato.com] Time Based SQL Injection

Summary

@samengmg found an cookie based SQL injection on https://reviews.zomato.com.

I noticed that two cookies were submitted during a request during the login page of https://reviews.zomato.com

orange
squeeze

Due to the oddly named cookies, I decided to fuzz them. Eventually, I discovered both are vulnerable to SQL injection with different techniques.

For orange cookie Initial payload to determine issue

1'=sleep(10)='1 

Not only the server slept for 10 seconds but the HTTP response code was 200 (the normal response is a 302 redirect)

This led me to craft out the following payloads: Payloads used to determine database version:

'=IF(MID(VERSION(),1,1)=1,SLEEP(10),0)='1
'=IF(MID(VERSION(),1,1)=5,SLEEP(10),0)='1

For squeeze cookie: Initial payload to determine issue

1 ' or true# 
1 ' or false#

From here it was pretty straightforward.

Thank you Zomato team for the highest bounty stated in the policy.