# [www.zomato.com] SQLi - /php/██████████ - item_id

Blind SQL injection in Zomato's item_id POST parameter, exploitable via time-based sleep() to extract database contents including private user data.

- Payout: $4,500
- Severity: critical
- Program: Eternal
- Credited: gerben_javado
- Disclosed: 2018-09-11
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/403616
- Library page: https://bugbountylibrary.com/r/h1%3A403616
- Tags: domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:critical tech:php technique:blind technique:source-review vuln:sqli

**Target:** PHP endpoint /php/██████████ (add_menu_item_tags)
**Root cause:** Unsanitized item_id POST parameter concatenated into a SQL query, allowing injection after the integer prefix.
**Steps:**
1. Send `POST /php/██████████` with body `res_id=1111&method=add_menu_item_tags&item_id=1111-sleep/*f*/(10)&new_tags[]=3&menu_id=1111` using Akamai Kona bypass comment `/*f*/`
2. Observe ~10s delay confirming time-based blind SQLi
3. Increment the leading integer each request to defeat DB caching keyed on the int value
4. Extract data via `item_id=1111-if(mid(version/*f*/(),1,1)=5,sleep/*f*/(5),0)` and compare response times
**How found:** Researcher tested the item_id parameter, discovered DB caching keyed on the integer prefix (repeated payloads stopped working), and worked around it by incrementing the integer each request; used sleep() to confirm injection.
**Exploitation:** Time-based blind SQLi: attacker sends crafted item_id values with sleep() wrapped in /*f*/ to bypass Akamai Kona WAF, using conditional if(mid(version(),...)) to exfiltrate data bit-by-bit via response timing. Integer prefix must be rotated each request to avoid caching.
**Insight:** When a payload stops working on repeat, suspect result/query caching keyed on a numeric prefix — rotate that integer per request to keep the injected tail fresh; also try WAF-bypass comments like /*f*/ inside function names.