# SQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll Database

Time-based SQL injection in a Starbucks XML upload endpoint backed by Microsoft Dynamics AX exposed nearly a million accounting/payroll records.

- Payout: hidden
- Severity: critical
- Program: Starbucks
- Found by: spaceraccoon
- Disclosed: 2019-08-06
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/531051
- Library page: https://bugbountylibrary.com/r/h1%3A531051
- Tags: area:web domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:critical tech:rest technique:blind technique:source-review vuln:sqli

**Target:** XML file upload web service backed by Microsoft Dynamics AX
**Root cause:** User-supplied XML node values (e.g. MainAccount) were concatenated into SQL WHERE clauses without parameterization; apostrophes escaped as ' entities bypassed the naive quote filtering.
**Steps:**
1. Enumerate subdomains to find an HTML file upload form.
2. Submit XML; verbose errors reveal expected nodes like `MainAccount`, `Credit`, `Debit`, `Invoice` and Microsoft Dynamics AX backend.
3. XXE blocked; only Billion Laughs DoS achievable.
4. Inject apostrophe as XML entity: `<MainAccount>123456'</MainAccount>` to bypass escaping and trigger `database error`.
5. Confirm time-based injection manually, then run `sqlmap --tamper htmlencode`.
6. Enumerate Dynamics AX default main table via public docs to confirm data volume/recency.
**How found:** Initial file-upload testing revealed XML processing and Dynamics AX via verbose errors; XXE failed, so on revisit suspected numeric MainAccount fed a WHERE clause. Apostrophe appeared escaped until realizing XML requires `'`, which bypassed filtering and produced a database error.
**Exploitation:** Attacker uploads crafted XML with entity-encoded SQL payloads in numeric fields; server concatenates into SQL query, enabling time-based blind extraction of the Dynamics AX database (SQL Server 2012), yielding ~1M accounting records.
**Insight:** When a parameter appears safely escaped, check whether the transport encoding (XML entities, JSON unicode, URL encoding) is decoded after the filter — encode the quote as `'` to reach the SQL layer.