# SQL Injection on sctrack.email.uber.com.cn

Base64-encoded JSON parameter on Uber China's unsubscribe endpoint passed user_id into SQL unsanitized, allowing time-based blind injection and database/user enumeration.

- Payout: $4,000
- Severity: high
- Program: Uber
- Credited: orange
- Disclosed: 2016-07-25
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/150156
- Library page: https://bugbountylibrary.com/r/h1%3A150156
- Tags: domain:web impact:data-leak kind:bounty platform:hackerone sev:high tech:email technique:blind vuln:sqli

**Target:** sctrack.email.uber.com.cn unsubscribe.do endpoint (base64 JSON param)
**Root cause:** The base64-encoded JSON `p` parameter is decoded and its `user_id` field concatenated directly into a SQL query without parameterization.
**Steps:**
1. Receive Uber China ad email, note unsubscribe link points to `sctrack.email.uber.com.cn/track/unsubscribe.do?p=<base64 JSON>`.
2. Decode `p` to JSON `{"user_id": ..., "receiver": ...}`.
3. Inject `5755 and sleep(12)=1` into user_id, re-base64, request; observe 12s delay.
4. Run blind extraction script using `mid(user(),N,1)='c'#` to dump DB name and user.
**How found:** Researcher noticed the unsubscribe link in a China Uber ad email differed from the normal one, inspected the base64 `p` parameter, decoded it to JSON, and tested the user_id field for injection.
**Exploitation:** Attacker crafts base64-encoded JSON with SQL payload in user_id and requests the unsubscribe URL; boolean/time-based blind extraction leaks MySQL user (`sendcloud_w@10.9.79.210`) and database name (`sendcloud`).
**Insight:** Marketing/tracking subdomains on regional domains often decode base64 JSON params and concatenate fields into SQL; decode opaque params and test each JSON field for injection.