SQL Injection vulnerability found on ibm.com endpoint

Summary

SQL Injection vulnerability found on ibm.com endpoint was reported to IBM, analyzed and has been remediated. Thank you to our external researcher @cr3ckerxploit.

A time-based blind SQL Injection vulnerability was discovered in a legacy CGI script (NEWaptresults.cgi) on an official IBM events subdomain. The learnpaths GET parameter did not properly sanitize user input, allowing an unauthenticated attacker to inject malicious SQL code.

Using both manual testing and automated tools, it was confirmed that the backend database would execute arbitrary queries. The injection was verified via time-based payloads (e.g., SLEEP(5)), which caused a measurable delay in the server's response, proving that user-supplied input was being evaluated as part of an SQL query.

Exploitation of this vulnerability could allow an attacker to enumerate database names, extract all stored records, and potentially access sensitive information such as user data, internal configurations, or authentication credentials. No authentication was required to trigger the vulnerability, making it accessible to anyone on the internet.