- Title: SQL injection in viestinta.lahitapiola.fi.
- Reported by: Yasar and Anandakshya.
- Bounty Rewarded: $1,350 and $1,560.
- Web application URL: https://viestinta.lahitapiola.fi.
- Description: Localtapiola is basically an insurance company that provides different kinds of life and non-life insurance policy to its customers; with its digital presence and online transaction-based system, it has one of the most active programs on Hackerone. Localtapiola had two very descriptive SQL injection reports that I decided to include in this chapter.
SQL injection by Yasar:
This was a very simple error-based SQL injection in Localtapiola, which Yasar identified. The URL where the SQL injection was found was as follows: http://viestinta.lahitapiola.fi/webApp/cancel_iltakoulu?regId=478836614&locationId=464559674.
The vulnerable parameter was regId. He simply used sqlmap to exploit the SQL injection after identifying it:
./sqlmap.py -u "http://viestinta.lahitapiola.fi/webApp/cancel_iltakoulu?regId=478836614&locationId=464559674" -p regId
He then obtained the desired output of the exploit code and was able to verify the SQL injection.
SQL injection by Anandakshya:
This was another SQL injection of a similar nature found by Anand. He identified the vulnerability in the email parameter and exploited it by sqlmap there on http://viestinta.lahitapiola.fi/webApp/omatalousuk?email=aaaaa.