Read the researcher's report on HackerOne
The report describes blind SQL injection in an account identifier parameter on a JavaScript import-status feature. Automated testing reportedly identified boolean- and time-based behavior and listed database names, but no access to specific records or further impact is demonstrated.
How it was found
- The researcher tested the account identifier parameter with an automated SQL injection tool.
- The tool reported boolean-based and time-delay responses consistent with blind SQL injection.
- The tool listed database names; the report provides no evidence of reading or changing records.
- Access needed
- No account
- User interaction
- None
- Whose object
- No object involved
- Boundary crossed
- Untrusted input reached a database query and enabled inference of database metadata.
- Root cause
- The feature appears to incorporate the supplied account identifier into a database query without safe parameterization.
- Impact
- An unauthenticated attacker may be able to infer database information; broader data access or modification is asserted but not demonstrated.
- Payload class
- Boolean-based and time-based SQL injection tests
- Components
- import-status endpoint, database query
- Confidence
- medium
This analysis is CyberSIXT's own summary of the public report, written by a model and checked automatically. It may be wrong: the researcher's report is the source. Written 2026-11-14. Ask for a correction or removal.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| SQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll Database | No account | Another user's | Unauthenticated XML input reached database queries and exposed enterprise accounting records. |
| SQL injection in https://labs.data.gov/dashboard/datagov/csv_to_json via User-agent | No account | No object involved | HTTP request input crossed into database query execution. |
| SQL Injection in report_xml.php through countryFilter[] parameter | Not clear from the report | No object involved | A request parameter reportedly crossed the application-to-database query boundary. |
| [www.zomato.com] SQLi - /php/██████████ - item_id | Not clear from the report | No object involved | A request parameter crossed into database query interpretation. |
| SQL Injection on cookie parameter | Not clear from the report | No object involved | No boundary crossing was demonstrated; only a database error response was observed. |
| SQL Injection in agent-manager | Not clear from the report | No object involved | Untrusted query input may have crossed into database query execution. |
| Blind SQLi leading to RCE, from Unauthenticated access to a test API Webservice | No account | No object involved | Unauthenticated API input reached SQL execution and then operating-system command execution on a production server. |
| Blind SQL Injection on starbucks.com.gt and WAF Bypass :* | No account | No object involved | User-controlled input reached database queries, enabling extraction of schema information. |
| www.drivegrab.com SQL injection | No account | Another user's | Unauthenticated preview input crossed into database queries and exposed stored form data. |
| SQL injection in GraphQL endpoint through embedded_submission_form_uuid parameter | No account | No object involved | An unauthenticated GraphQL request reached PostgreSQL statement execution. |
| Sql injection on docs.atavist.com | No account | No object involved | Unauthenticated input reached a database query through the story-listing API. |
| bypass sql injection #1109311 | No account | No object involved | A login-form input may have crossed into database query execution. |