Reports Programs Subdomains Program: Eternal Status Severity Weakness: SQL Injection Year Bounty paid10 Access stated No account 0 A user account 0 Admin or privileged 0 No option matches.
Access needed Technique Clear filters 11 of 15,219 reports Disclosed bug bounty reports Report Status Weakness Severity Disclosed Bounty Votes [www.zomato.com] SQLi - /php/██████████ - item_id Analysed #403616 Valid SQL Injection – 2018-09-11 $4,500 326 Solr Injection in `user_id` parameter at :/v2/leaderboard_v2.json Analysed #952501 Valid SQL Injection – 2020-08-10 $2,000 137 [https://reviews.zomato.com] Time Based SQL Injection #300176 Valid SQL Injection – 2018-02-02 $1,000 72 [www.zomato.com] Blind SQL Injection in /php/geto2banner #838855 Valid SQL Injection – 2020-08-10 $2,000 68 [www.zomato.com] SQLi on `order_id` parameter #358669 Valid SQL Injection – 2018-05-30 $1,000 63 [www.zomato.com] Union SQLi + Waf Bypass #258582 Valid SQL Injection – 2017-09-19 $1,000 61 [www.zomato.com] Blind SQL Injection in /php/widgets_handler.php #836079 Valid SQL Injection – 2020-08-10 $2,000 54 [www.zomato.com] Boolean SQLi - /█████.php #297534 Valid SQL Injection – 2018-03-29 $1,000 41 [www.zomato.com] Boolean SQLi - /███████.php #301257 Valid SQL Injection – 2018-03-29 $1,000 35 SQL Injection, exploitable in boolean mode #246412 Valid SQL Injection – 2017-07-19 – 20 [www.zomato.com] Abusing LocalParams (city) to Inject SOLR query #844428 Valid SQL Injection – 2020-08-10 $100 11
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.