SQL Injection: How I Secured Personal Information (PII) of 1.1M Job Seekers

Hello, my name is Biraj Baishya, aka brutexploiter. I am an independent security researcher, a full-time bug bounty hunter, and a mechanical engineer.

In this write-up, I will discuss how I discovered an SQL Injection vulnerability and protected the data of approximately 1.1 million job seekers. This vulnerability could have been exploited by cyber attackers, potentially leading to a massive data breach.

Let’s begin… but first, let’s learn some basic terms:

SQL injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. This can allow an attacker to view data that they are not normally able to retrieve. This might include data that belongs to other users, or any other data that the application can access. In many cases, an attacker can modify or delete this data, causing persistent changes to the application’s content or behavior.

Read more: https://portswigger.net/web-security/sql-injection

The discovery phase of the vulnerability is quite interesting. I visited https://staterecruit.in as a job seeker. Since the government recently announced Grade III and Grade IV jobs, I visited the site and began the job application process. As a security enthusiast, whenever you surf the web, you’re naturally curious about how things work.

After submitting the form, I encountered the acknowledgment page, which seemed fine. However, my first question was: how is the data retrieved from the server? To investigate further, I opened the Developer Tools in Firefox (F12) and navigated to the Network tab. Since I couldn’t see any API calls, I concluded that the id parameter is responsible for data retrieval from the database.

The first thing that came to my mind after seeing the id parameter is SQL Injection. Since the id parameter is one of the most common targets for SQL Injection attacks.

When testing for SQL Injection, the first step is to detect the SQL injection vulnerability. Therefore, the first thing I did was enter a single quote character ' and look for errors or other anomalies. Upon entering the single quote character ', the server throws a SQL error in response.

Note: Sometimes the server won’t show any error message in response. In that case, we have to test for blind SQL Injection.

The next thing is to find the number of columns and query the database type and version.

For Finding the columns:

ORDER BY 1

ORDER BY 2

ORDER BY 3 and so on

For querying the database:

To automate the process I have used sqlmap.

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.

sqlmap command:

sqlmap result:

Observe that the server returns an SQL error.

Payloads:

Successful exploitation of this vulnerability could result in unauthorized access to sensitive data, modification of database contents, or other actions depending on the permissions associated with the database user.

Personally Identifiable Information (PII) :

On the bright side, the data of 1.1 million job seekers is secure now. Unfortunately, some organizations address the issue quietly and proceed without providing any acknowledgment or update regarding the fix.

Nonetheless, what truly matters is that the data of 1.1 million users is now safer, and that remains my primary concern.

Thank you for reading. I hope you enjoyed reading the write-up!

References:

For collaboration or any other queries, please contact me at brutexploiter@gmail.com

LinkedIn: https://www.linkedin.com/in/brutexploiter

X: https://x.com/brutexploiter