During my testing I have found a vulnerable parameter in an API
(/api/v1/documents/?direction=desc&limit=30&mode=reports**&page=1**) and its parameter is
page=1 at the end. Upon giving the parameter a NULL value,
&page=, it returns the following error.
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '-30, 30) AS `UserDocuments` LEFT OUTER JOIN `tasks` AS `Tasks` ON `UserDocuments` at line 1
While if I input ` at the end of value,
page=1` it returns the following error
Undeclared variable: NaN","sql":"SELECT `UserDocuments`.*, `Tasks`.`id` AS `Tasks.id`, `Tasks`....
I have the following questions in my mind: I have tried exploiting it but am unable to do so. How can I exploit this parameter as it is returning a syntax error? Also if it is not exploitable is it still vulnerable to SQL injection or some attack?
Please note that it is a GET request and the response is in JSON, while the application is developed on PHP.