I found and responsibly reported a critical unauthenticated SQL injection in a production HR portal used by an educational institute. I stopped after confirming the issue, documented its impact and scope, and privately disclosed it to the institute’s leadership.
During security research I came across an unauthenticated SQL injection in the login form of a production HR portal used by an educational institute.
A single quote in the username field was enough to break the query.
Verbose application errors confirmed that the database, including employee and payroll data, was within reach.
I stopped testing there: No data was read, no login was bypassed, nothing was extracted.
I documented the injection point, the impact and the scope, and wrote out the exact fixes (parameterised queries, error handling, least-privilege database access).
I sent a private disclosure to the institute's leadership with a 90-day remediation window.
My takeaway is: What you do next is what makes it security research.