# Blind SQLi leading to RCE, from Unauthenticated access to a test API Webservice

Unauthenticated WSDL API on starbucks.com.cn exposed functions leaking user data and a blind SQLi enabling xp_cmdshell RCE on a production server.

- Payout: hidden
- Severity: critical
- Program: Starbucks
- Found by: geek_jeremy
- Disclosed: 2019-07-22
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/592400
- Library page: https://bugbountylibrary.com/r/h1%3A592400
- Tags: area:web domain:api impact:data-leak impact:pii-leak impact:rce kind:bounty platform:hackerone sev:critical tech:rest technique:blind vuln:auth-bypass vuln:rce vuln:sqli

**Target:** SOAP/WSDL API webservice on non-standard port
**Root cause:** Unauthenticated SOAP functions exposed user/password data, and at least one function concatenated input into SQL queries without sanitization, allowing blind injection.
**Steps:**
1. Discover browsable WSDL on API endpoint under starbucks.com.cn on a non-standard port
2. Invoke unauthenticated functions to list users, passwords and PII
3. Identify a function vulnerable to blind SQL injection
4. Inject blind SQLi payloads to extract database contents
5. Escalate via `xp_cmdshell` to execute OS commands, demonstrating with `ping`
**How found:** Noticed a browsable WSDL service on a non-standard port under starbucks.com.cn; tested functions and found they executed without authentication, then probed for injection.
**Exploitation:** Attacker reached the WSDL unauthenticated, enumerated exposed functions to dump user credentials/PII, then used blind SQLi in a vulnerable function to read the database and invoke xp_cmdshell for command execution on the production server.
**Escalation:** Blind SQLi chained to xp_cmdshell for OS command execution, turning data disclosure into RCE.
**Insight:** Browsable WSDL on non-standard ports under regional domains often exposes unauthenticated SOAP methods; enumerate every operation for auth gaps and injectable parameters, and check for xp_cmdshell when the backend is MSSQL.