Read the researcher's report on HackerOne
No analysis of this report yet. What HackerOne publishes about it is below, with the link to the report.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| SQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll Database | No account | Another user's | Unauthenticated XML input reached database queries and exposed enterprise accounting records. |
| SQL injection in https://labs.data.gov/dashboard/datagov/csv_to_json via User-agent | No account | No object involved | HTTP request input crossed into database query execution. |
| SQL Injection in report_xml.php through countryFilter[] parameter | Not clear from the report | No object involved | A request parameter reportedly crossed the application-to-database query boundary. |
| [www.zomato.com] SQLi - /php/██████████ - item_id | Not clear from the report | No object involved | A request parameter crossed into database query interpretation. |
| SQL Injection on cookie parameter | Not clear from the report | No object involved | No boundary crossing was demonstrated; only a database error response was observed. |
| SQL Injection in agent-manager | Not clear from the report | No object involved | Untrusted query input may have crossed into database query execution. |
| Blind SQLi leading to RCE, from Unauthenticated access to a test API Webservice | No account | No object involved | Unauthenticated API input reached SQL execution and then operating-system command execution on a production server. |
| Blind SQL Injection on starbucks.com.gt and WAF Bypass :* | No account | No object involved | User-controlled input reached database queries, enabling extraction of schema information. |
| www.drivegrab.com SQL injection | No account | Another user's | Unauthenticated preview input crossed into database queries and exposed stored form data. |