The app tracks visitor IPs via the X-Forwarded-For header and drops the raw value into a SQL query. Here's how to exploit it.

OopsSec Store tracks visitor IPs on every page load using the X-Forwarded-For header. The value goes straight into a raw SQL query with no sanitization, so we can inject arbitrary SQL through a header that's entirely client-controlled.

Lab setup

From an empty directory:

npx create-oss-store oss-store cd oss-store npm start

Enter fullscreen mode

Exit fullscreen mode

Or with Docker (no Node.js required):

docker run -p 127.0.0.1:3000:3000 leogra/oss-oopssec-store

Enter fullscreen mode

Exit fullscreen mode

The app runs at http://localhost:3000 .

Target identification

The application silently tracks visitor IP addresses on every page load.…