[www.zomato.com] Abusing LocalParams to Inject Code through ███████ query

Summary

@bigshaq found an endpoint which was throwing 500 Internal Server Error after adding a double quote, while he thought that this behaviour might well be a SQLi, and after a bit of fuzzing @bigshaq demonstrated why he believed it to be a SQLi >

 - 500 (ISE) > domain.com?type=redacted&id=1"
 - 200 > domain.com?type=redacted&id=1""
 - 500 > domain.com?type=redacted&id=1"""
 and so on.

After some research @bigshaq was able to come up with a POC which resulted in getting the list of all the cities in a single query, we did the investigation internally and found that this could well lead to a Code Injection on one of our Server (which didn't had any sensitive information [those were already public data]).

We would like to thank @bigshaq for his finding which helped us investigate and remediate an issue.

Cheers.