From “Just an Error” to Full Read/Write Access on Someone Else’s Data
Hey, folks! While doing normal testing on the target, I noticed an **internal API** for the first time — I hadn’t paid much attention to it before. So I started poking at it. There’s an endpoint that’s supposed to just give you **metadata about your own product** — nothing fancy, tied to whatever product_id belongs to you.
Chapter 1: The Boring Start
I started simple. Sent this filter:
{product_id==00000000–0000–0000–0000–000000000000' OR 1=1 - }And got back a **500 server error**:
query product tasks: ERROR: invalid input syntax for type uuid: “00000000–0000–0000–0000–000000000000' OR 1=1 — “ (SQLSTATE 22P02)Kept trying a bunch of different payloads after that, and every single one gave me the exact same error. Then I said screw it, let’s go simple:
chapter 2 : Bingo!!
Then I said screw it, let’s go simple: !=*
BOOOM. All products loading. I so happy 😂
Reported it as SQL Injection, got flagged as **needs more info** — turned out it wasn’t injection at all. The real cause: **an unrecognized filter made the backend silently drop the WHERE clause** and return everything. Different cause, same wide-open result.
Chapter 3: Not Stopping There
First time seeing that endpoint, so I kept digging instead of walking away. Turned out it also supported GET and POST on a resource id:
Get Mostafa shaban’s stories in your inbox
Join Medium for free to get updates from this writer.
/products/{id}
Tried a GET on a resource that wasn’t mine. **Full metadata, no restrictions.** Actual content tied to someone else’s account, not just IDs and timestamps.
Lol!! all meta data from any prodect
Then I tried a POST to mess with the fields on that resource. Only **one field** actually changed — the url.
So I swapped the method to PATCH instead.
All fields changed !!🔥🔥
That’s the moment this stopped being “I can read data that isn’t mine” and became a real integrity problem one account quietly overwriting data another account depends on.
The creation flow also trusted any owner/account ID I supplied, letting me create resources under accounts I didn’t own.
here we go!!😍
Thanks for reading.
Follow me:
