The bug which worth 2k$

#security #api #graphql #sql

I was testing around a public program on Bugcrowd. The program does not allow public disclosure so I will call it redacted.com, it was public for about 7 years and lots of 1337 (1337 => hackers) have tried it for security vulnerabilities, so I was testing around and was so frustrated, as those were my starting days. Being frustrated I took a break and thought what am I doing I revert back the 1337 methodology which is try harder. I took a break and got to sleep after waking up I realize a request which was fetching my saved items so I immediately turn my laptop on and started looking for the request by capturing the request with BurSuit so, there was a request which retrieved my saved items and it was sent via GraphQL to the server after entering a semicolon to the saved saved_items_id got the SQL syntax error. After reporting the issue within a week got 2k$ bounty and an immediate fix was applied to the endpoint