ITSEC Newsletter 2025-10-09

After my original blog post published in late 2020, I kept encountering the same vulnerability across different database management systems. The problem was always the same: Time-based techniques were not possible, the responses did not contain any data that could be turned into a boolean-based injection, OR-based payloads did not return useful values or did not work, Out-of-band (OOB) techniques were not possible.

This is me, Aga, your friendly neighbourhood editor-in-chief. It seems that every time we meet, something new has been unlocked for our zine. This time is no different, we have broken out of our online space, and got to see you offline, in the mysterious real world in which I definitely live.

Important note: This platform was a pilot project at a company that is not being named. It ran into 2024 and is no longer active today. There were only a handful of customers and generators registered. Despite that, this should be a fun, cautionary tale that API security must be taken as a priority from day one to avoid big consequences later!