SQLi · critical
The store finder that sorted by anything you asked
An allowlist that covered the column name but not the sort direction, on a public endpoint with no authentication. Blind SQL injection into the production database, reachable by anyone with a browser.
· 15 min read $5k - $10k