[hoesfucker]

Hello, 

Yesterday, I was feeling bored and came across a Russian service that offers "mystery shopper" services. I attempted to hack into it and discovered a SQL injection vulnerability. This service worked with some of the largest companies in Russia, including MegaFon, Tele2, Magnit, Rosneft and others. 

For Each company there were own dashboard where I found inspection reports covering aspects such as cleanliness, staff responsiveness etc .... .
Here example screenshot:


There were even recordings of conversations with managers, which appeared to be made using hidden audio devices. 

However, the most intriguing information wasn't in the reports themselves; it was the fact that the full names and email addresses of employees from each company were accessible. For example, here are a couple of lines regarding employees from Tele2:

107,1,11,1,Лебедь Екатерина Викторовна ,NULL,0,[email protected],1,357389,NULL,100
108,1,11,1,Стенягина Анжела Сергеевна ,NULL,0,[email protected],1,357349,NULL,100
109,1,11,1,Ельникова Евгения Викторовна ,NULL,0,[email protected],1,468938,NULL,100
110,1,11,1,Горобец Анастасия Евгеньевна ,NULL,0,[email protected],1,897806,NULL,100
111,1,11,1,Шелякина Оксана Александровна  ,NULL,0,[email protected],1,357357,NULL,100

does this data have any value or not?

[mellstroy1er]

I think yes, but I will check again with a bro, thanks for sharing

[Kh0dAk2]

Yes, I think that it is valuable info, It can be used for a lot of things.

[hoesfucker]

i will reopen this topic. maybe i will find people who needs this

[pompeya]

great job! what type of SQLi work fo it? all the information are interesting, could you try to sell to the portal, provably they give you a 1337$ Big Bounty

[masedan]

To check the value of what you got, try to see:
- how many data you have
- are there any personal data (name, phone, email, password, ...)
- then are these data supposed to be private or not

After it's up to you to see what you wanna do with it:
- as @pompeya was saying, you can try to contact the portal if they have bounties available, and if you dont want to spread these data
- you can also share it on BF too, for free or for $$$ depending on how important are these data and how you feel about it

[ahmadwaqar]

Every data is valuable and can come in handy.

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching.