A bug hunter discovered a critical SQL injection vulnerability in a password reset flow by testing the `ukey` token parameter in a forgot-password email link. The parameter was passed directly into a MariaDB query via string concatenation with no sanitization or prepared statements. Using SQLMap, full read access to every database table — including user credentials, admin accounts, and session tokens — was achieved with a single parameter modification. The vulnerability was reported in early 2025 but remains unpatched 16 months later. The writeup explains why reset tokens are routinely overlooked by both manual testers and automated scanners, and advises security researchers to always test email-delivered URL parameters.
Table of contents
The ukey Token — Full Database, One PayloadGet LordofHeaven’s stories in your inboxWhy the Reset Token Is Always UntestedReported in 2025. Checked in 2026. Still There.If You Hit a Dead End — Open Your Inbox2.2K Impressions1 Comment