Uber · Report #476150
SQLI on desafio5estrelas.com
Validstatus
mediumseverity
$2,500bounty
29upvotes
29 Mar 2021disclosed
Summary
Vendor created and managed site desafio5estrelas.com had a SQLI vulnerability which could potentially expose sensitive data.
A time-based blind MYSQL SQLI vulnerability existed at the endpoint https://desafio5estrelas.com/login in the URL parameters "codigo".
Basic SQLI that was found on an uber vendor microsite
Check out my blog https://healdb.tech/blog/ or my Twitter https://twitter.com/heald_ben for some Bug Bounty tool releases and blogs!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.