Researcher Documents Full SQL Injection to Remote Code Execution Chain on Web API

A security researcher has published a technical proof-of-concept detailing a critical boolean-based blind SQL injection vulnerability found in a web application's search API, rated CVSS 9.8. The attack chain begins with injecting true and false SQL conditions into the search endpoint to confirm differing response sizes, enabling character-by-character data extraction. By exploiting stacked SQL queries, the attacker can remotely enable the xp_cmdshell feature in Microsoft SQL Server, ultimately achieving remote code execution with sysadmin privileges. The researcher first verified that the compromised database user held sysadmin-level access before proceeding to the command execution phase. The write-up is intended as an educational demonstration of how a seemingly limited blind injection flaw can escalate into full server compromise.