SQL Injection (CWE-89)CVSS 10€1,000 PRO
Unauthenticated Error-Based SQL Injection via an Identity Header (SiteMinder SM_USER)
A critical SQL injection vulnerability in an authentication endpoint allows attackers to execute arbitrary SQL commands, access sensitive data, and manipulate the database.
1. Summary
An internal HR / employee-incentives portal in production sat behind a WebSSO (SiteMinder-style) in front of an application backend. Two flaws were chained:
- Authorization bypass via a static extension. The protected dynamic route
(
/appPath/) could be reached without authentication by appending an encoded static suffix —/appPath/0%3f.jpg. The WebSSO proxy treats the request as if it asked for a static asset (an image) and skips access control, while the backend still dispatches the dynamic handler for the route.