1

So I have a vulnerable web page which uses Express framework for NodeJS. The vulnerable web page accepts the following traffic and returns a json data

GET /findInfo?user=12345678 HTTP/1.1
Host: example.com
X-Requested-With: XMLHttpRequest

The output is in json. The user id parameter user takes an 8 digit integer user id. Since this website is using Express, I wanted to see if I can get the data using Query Selector injection.

So I tried the following request.

GET /findInfo?user[]=12345678 HTTP/1.1
Host: example.com
X-Requested-With: XMLHttpRequest

I'm getting the same response as the first request. Unless this is just some kind of stripping, the webserver is doing a query selection which would obviously return the same data.

But when I try something like user[$gt]=, the service is returning empty json data. Does this mean its not vulnerable? Is there any play here?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.