So I was bored and decided to get into some bug bounty hunting. I went on a website that has a bug bounty program and this website is for downloading apps. I went to the enter a gift card code field and targeted it in Intruder in Burp Suite. Loaded up a list of payloads containing common SQL Injection strings and the 5th line had an interesting response.
"This will update the balance for xxxxx"
Kind of surprised it worked I copied the string and entered it in manually into the field on the website and got the response in my browser. Sure enough I got the same prompt and when I clicked "Update Balance" it said it was an incorrect code.
The SQL Injection string:
How can this be exploited with the given information? Can it be exploited at all or is this just a logical error?
Any info or advice would be much appreciated.