amjadafanah / FX-SAAS-9

This project is for testing the security and quality of APIs in FX SaaS
0 stars 0 forks source link

FX-SAAS-9 : ApiV1AccountsSearchGetPathParamSqlInjectionTimeboundMysqlPagesize #1391

Open amjadafanah opened 6 years ago

amjadafanah commented 6 years ago

Project : FX-SAAS-9

Job : Dev

Env : Dev

Region : FXLabs/US_WEST_1

Result : fail

Status Code : 400

Headers : {X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZDkzODk1NjEtYmZkYi00ZmFmLWIzODItZDI3N2FhMzc0ZmMy; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Fri, 05 Oct 2018 11:22:01 GMT]}

Endpoint : http://13.56.210.25/api/v1/accounts/search?pageSize=' or benchmark(7000000000,charset('abc')) = 0 ; --

Request :

Response :
{ "timestamp" : "2018-10-05T11:22:02.675+0000", "status" : 400, "error" : "Bad Request", "message" : "Failed to convert value of type 'java.lang.String' to required type 'java.lang.Integer'; nested exception is java.lang.NumberFormatException: For input string: \"'orbenchmark(7000000000,charset('abc'))=0;--\"", "path" : "/api/v1/accounts/search" }

Logs :
Assertion [@StatusCode != 404] resolved-to [400 != 404] result [Passed]Assertion [@ResponseTime < 7000] resolved-to [8723 < 7000] result [Failed] --- FX Bot ---