I'm trying to find security issues on my friend's site. There is an input box for subscription. I can enter my email address:
Henry<IMG SRC=# onmouseover="alert('xxs')">@gmail.com
After trying different things, I noticed
" get rejected.
But it accepts
If I put my mail as
Server accepts the request.
And show response as
You are successfully subscribed
It mean my email stored to the database.
Any possibilities for Sql injection? Or any other vulnerabilities? Or Blind injections?