[SERPENT@]

Hello guy's.. In the below HTTP request it said parameter: administration_id , was vulnerable.. Anyone can help me to inject it?

For inject it, you need to register and logged-in to view this content.

I have tryed with SQLMAP, but not working..

PHP Code


<?php 
GET /product_updates?administration_id=237891964997994205 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Referer: https://moneybird.com/237891964997994205
Cookie: _mb_session=eyJzdWIiOiJNekkydDdBMHREUXpzVFEzc1RReU5UVTJCQUEiLCJleHAiOjE1NTEyNTU1NTIsImF1ZCI6InExWXlNamEzc0RTME5ET3h0RFMzdERReE1qQlZzb28yTTlaUjhxOG9yUENQOG5ZMnkzSHlLUWtKejhzTGQwMExMX0MxOFBVd0x5Z3pxREF1aVRMS0RnM3hNN1EwTHJaVmlxMEZBQSIsIm5hbWUiOiJVeXBJTFVrdFVnSUEiLCJlbWFpbCI6IlV5cE9UUzVJelN0SkxTNUpMVEkwTmpaM0tDaktMOG5QeTAzTXpORkx6czlWQWdBIiwiem9uZWluZm8iOiJVM0l0TGNvdlNOVjN6QzB1U1MxS1NjeFZBZ0EiLCJsb2NhbGUiOiJubCJ9.e3ls88UtpN7-3HVHq_M9uNv-h6-p4o_czSsrVHwYnlIN4rq3hBVRsS6jA-o5lrq9PFoxmBwC52PpdcqsIW1RCA; trusted_computer=true; _moneybird_session=e566b43b8f4e703ffbf76cd03f2e1ea8c598d490e0343d0923ef3b8a1b94b53d
Connection: Keep-Alive
Host: moneybird.com
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US 


[Sitrep]

"administration_id" are a part of moneybird as an API and "237891964997994205" are your authentication token. Just some information that I found out, if it helps anything. I'm not sure if or how you can Sqli an API like that, but maybe someone with more knowledge have a good answer.

[hacker1]

use hack bar dude and do convert the strings to characters.