# Blind SQL injection on id.indrive.com

Blind SQL injection in id.indrive.com path segment let an attacker inject boolean conditions and extract database info including PostgreSQL version.

- Payout: $4,134
- Severity: critical
- Program: inDrive
- Found by: kristoferent
- Disclosed: 2023-11-24
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2051931
- Library page: https://bugbountylibrary.com/r/h1%3A2051931
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:critical tech:rest technique:blind vuln:sqli

**Target:** REST API endpoint /api/ten-drives/custom-winners/.../number_trips on id.indrive.com
**Root cause:** The server does not sanitize user input in the URL path, allowing arbitrary SQL to be injected into the backend query.
**Steps:**
1. Visit https://promo.indrive.com/10ridestogetprize_ru/random and click "Сгенерировать" to trigger a request to https://id.indrive.com/api/ten-drives/custom-winners/ten_drive_kz_second_weeks/number_trips/29/5/phone
2. Change the path to `/api/ten-drives/custom-winners/ten_drive_kz_second_weeks/number_trips/1/999%20or%201=1--`; a random DB entry is returned
3. Change to `/api/ten-drives/custom-winners/ten_drive_kz_second_weeks/number_trips/1/999%20or%201=2--`; response is empty, confirming boolean injection
4. Use conditional responses to extract data, e.g. retrieved PostgreSQL 14.8 version
**Exploitation:** Attacker sends GET requests with injected boolean conditions in the number_trips path segment; true conditions return a random DB row, false conditions return empty, enabling blind data extraction.
**Insight:** Numeric path segments feeding DB lookups are injectable even without query params; test boolean tautologies like `1=1--` vs `1=2--` in URL path positions and use response presence/absence as the oracle.

## Proof of concept (copied exactly from the original report)

**SQLi payload 1=1 returns random entry**

```
/api/ten-drives/custom-winners/ten_drive_kz_second_weeks/number_trips/1/999%20or%201=1--
```

**SQLi payload 1=2 returns empty**

```
/api/ten-drives/custom-winners/ten_drive_kz_second_weeks/number_trips/1/999%20or%201=2--
```