[www.zomato.com] Abusing LocalParams to Inject Code through ███████ query

@bigshaq found an endpoint which was throwing `500 Internal Server Error` after adding a double quote, while he thought that this behaviour might well be a SQLi, and after a bit of fuzzing @bigshaq demonstrated why he believed it to be a SQLi > ``` - 500 (ISE) > domain.com?type=redacted&id=1" - 200 > domain.com?type=redacted&id=1"" - 500 > domain.com?type=redacted&id=1""" and so on. ``` After some research @bigshaq was able to come up with a POC which resulted in getting the list of all the cities in a single query, we did the investigation internally and found that this could well lead to a Code Injection on one of our Server (which didn't had any sensitive information [those were already public data]). We would like to thank @bigshaq for his finding which helped us investigate and remediate an issue. Cheers.