SQL Injection - data[account][id] parameter

How it was found

Description: Hi! I discovered a SQL Injection vulnerability in the data[account][id] parameter on the website ███████. The vulnerability allows for the manipulation of SQL queries executed by the backend database, which could potentially lead to unauthorized data access or manipulation.

References

████

Impact

The ability to manipulate SQL queries can lead to: Unauthorized access to sensitive data. Potential data leakage. Data manipulation or corruption. Full database compromise if administrative permissions are accessible.

System Host(s)

█████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

Use the sqlmap:

sqlmap -r file.txt --dbs --tamper=between --batch -p 'data[account][id]'

Use the file.txt attached to the report.

Suggested Mitigation/Remediation Actions

Use parameterized queries when dealing with SQL queries that contain user input. Parameterized queries allow the database to understand which parts of the SQL query should be considered as user input, therefore solving SQL injection.