Insecure CORS API
This endpoint returns Access-Control-Allow-Origin: * with credentials allowed.
API Endpoints
| Method | URL | Description |
|---|---|---|
| GET | ?endpoint=artists | Returns all artists as JSON |
| GET | ?endpoint=pictures | Returns all pictures as JSON |
| GET | ?endpoint=users | Returns users (SQLi vulnerable) |
| GET | ?endpoint=search&q=test | Search (SQLi vulnerable) |
Test CORS from Console
fetch('http://YOUR_SERVER/api.php?endpoint=users', {
credentials: 'include'
}).then(r => r.json()).then(console.log)
[{"userid":"90","uname":"Test User","email":"test@example.com","cc":"test","phone":null,"address":null},{"userid":"89","uname":"pHqghUme","email":"testing@example.com","cc":"4111111111111111","phone":null,"address":null}]