---
id: 9300
title: "Hacking Apple - SQL Injection to Remote Code Execution"
source_domain: projectdiscovery.io
source_url: "https://projectdiscovery.io/blog/hacking-apple-with-sql-injection"
published_at: "2024-05-08T23:21:21Z"
tags: ["bug-bounty", "rce", "red-team"]
phying_url: "https://phying.com/item/9300"
lang: en
---

# Hacking Apple - SQL Injection to Remote Code Execution

## Summary

Introduction In our last blog post, we delved into the inner workings of Lucee and took a look at the source code of Masa/Mura CMS, and the vastness of the potential attack surface struck us. It became evident that investing time in understanding the code could pay off. After dedicating a week to our exploration, we stumbled upon several entry points for exploitation, including a critical SQL injection flaw that we were able to exploit within Apple's Book Travel portal. In this blog post, we a

## Intelligence Metadata

- **Sources:** projectdiscovery.io
- **Published:** 2024-05-08T23:21:21Z
- **Original:** https://projectdiscovery.io/blog/hacking-apple-with-sql-injection
- **Phying News:** https://phying.com/item/9300