Hard
SQL Injection
Aegis Claims legacy API filter bypass
An insurance claims-status portal. The modern search is safe; an old partner API keyword-filters instead.
PentestingHere Academy
Official Academy lab
- Attempts
- 0
- Solves
- 0
- Published
- 25 Aug 2026
Scenario
Aegis Claims' public search is built on prepared statements and is safe. A legacy /api/v1/claims/search endpoint, kept for old partner integrations, still concatenates input into SQL and only blocks the literal word UNION.
Goal
Through the legacy /api/v1/claims/search endpoint, read the internal_audit table (the flag is in its audit_detail column), getting past the filter that blocks the literal word UNION.