So I have a vulnerable web page which uses Express framework for NodeJS. The vulnerable web page accepts the following traffic and returns a json data
GET /findInfo?user=12345678 HTTP/1.1
Host: example.com
X-Requested-With: XMLHttpRequest
The output is in json. The user id parameter user takes an 8 digit integer user id. Since this website is using Express, I wanted to see if I can get the data using Query Selector injection.
So I tried the following request.
GET /findInfo?user[]=12345678 HTTP/1.1
Host: example.com
X-Requested-With: XMLHttpRequest
I'm getting the same response as the first request. Unless this is just some kind of stripping, the webserver is doing a query selection which would obviously return the same data.
But when I try something like user[$gt]=, the service is returning empty json data. Does this mean its not vulnerable? Is there any play here?
