I am testing a website and I found an endpoint that accepts an e-mail address and returns a HTTP 200 response if that e-mail is registered, or 401 if that e-mail is not registered. But I also noticed that it is possible to use wildcards like * or ? in the email parameter. For example if I type myregisteredemail@*.com, I will get a HTTP 200 response, but if I type nonexistingemail@*.com, I will get a 401 response. The wildcards can be used anywhere in the email.
I know that this behavior could easily be used for e-mail enumeration, but I'm trying to figure out if there is maybe any other injection that would be more critical.
I have tested lots of SQLi payloads, but without success, and as far as I know, all SQL product use % as wildcard character and not * (% does not work in this example as wildcard). Is anybody aware of a SQL or noSQL product that uses * as wildcard character?