地图 / Time Based SQL Injection

Time Based SQL Injection

SQL 注入 / SQL 注入 / #1878584

厂商: U.S. Department of State
严重程度: 高危 · CVSS 9.3
赏金: —
弱点: SQL 注入
研究员: @shadow-krd
披露日期: 2023-04-20
资产: —
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（3118 字符中的一小部分）

Hello and greetings and respect to you, dear friends We all know that the sql injection bug is very dangerous, so this bug should be eliminated as soon as possible. I've identified an SQL injection vulnerability of type Time Based on█████████ ██████ Below, we see how we found this vulnerability If …

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 U.S. Department of State 所有。

时间线

2023-02-18报告提交
2023-04-20公开披露

阅读 HackerOne 原文 ↗作者 @shadow-krd · 版权归作者与 U.S. Department of State 所有

同类报告

SQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll DatabaseStarbucks · 2019-08-06 SQL injection in https://labs.data.gov/dashboard/datagov/csv_to_json via User-agentGSA Bounty · 2019-03-22 Time-Based SQL injection at city-mobil.ruMail.ru · — · $15,000 SQL injection at https://sea-web.gold.razer.com/ajax-get-status.php via txid parameterRazer · — · $2,000 SQL Injection in https://api-my.pay.razer.com/inviteFriend/getInviteHistoryLogRazer · — · $2,000 Blind SQL InjectionInnoGames · — · $2,000

Time Based SQL Injection · 破甲 POJIA