[nothing_as]

hi Friends,

i found some security file .js and How can exploit AJAX function from client?

-- example function --
function getRaw(user, id){
    var usr  = $('#user-carts').text();
    window.open('website?method=raw&user=' + (usr ? usr : user) + '&product=' + $('#purchases_product').val() + '&id=' + id, '_blank');
}

Can bypass authentication and call this function from client to get raw? any sugestion for me. Thanks

[Berry White]

I think you can try to look if one of this parameters are vulnerable to SQLi.
website.com?method=raw&user=1&product=1&id=1