# SQL Injection on prod.oidc-proxy.prod.webservices.mozgcp.net via invite_code parameter - Mozilla social inscription

PostgreSQL time-based blind SQL injection in the invite_code parameter of Mozilla's OIDC proxy signup endpoint, confirmed via PG_SLEEP delays.

- Payout: hidden
- Severity: critical
- Program: Mozilla
- Found by: supr4s
- Disclosed: 2024-01-30
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2209130
- Library page: https://bugbountylibrary.com/r/h1%3A2209130
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:critical tech:rest technique:blind technique:source-review vuln:sqli

**Target:** OIDC proxy signup endpoint (prod.oidc-proxy.prod.webservices.mozgcp.net) /interaction/.../signup
**Root cause:** The invite_code form parameter is concatenated into a PostgreSQL query without parameterization, allowing injected SQL to execute.
**Steps:**
1. Navigate to mozilla.social signup, which redirects to prod.oidc-proxy.prod.webservices.mozgcp.net and requires an invite code.
2. Observe the signup POST to `/interaction/<id>/signup` with body `handle=xxx&display_name=xxx&invite_code=xxx&age=25&terms=on&rules=on`.
3. Send `invite_code=xxx'` -> 500 error; `invite_code=xxx''` -> 200, indicating SQL parsing.
4. Confirm time-based blind with `invite_code=xxx');(SELECT 4564 FROM PG_SLEEP(5))--` and observe ~5s delay.
5. Repeat with PG_SLEEP(10) and PG_SLEEP(20) to confirm controllable delay.
**How found:** Researcher was exploring the invite-only signup flow, noticed the invite_code parameter, and tested quote injection: single quote caused 500, double quote returned 200 — a parser anomaly that prompted time-based blind confirmation.
**Exploitation:** Time-based blind injection confirmed via PG_SLEEP; researcher stated intent to perform data exfiltration but no extraction shown in the report.
**Insight:** On invite-gated signup flows, the invite_code is often validated with a raw SQL lookup; test quote-balance behavior (odd vs even quotes) as a fast oracle before moving to time-based blind payloads like `');(SELECT ... FROM PG_SLEEP(n))--`.