{"postId":"opengov:82","kind":"opengov","title":"Immunefi report - misconfigured SQL endpoint vulnerable to injection","body":"A publicly accessible GraphQL mutation named notify is exposed on the production endpoint https://galacticcouncil.squids.live/hydration-pools:prod/api/graphql. \n\nThis would allow attacker to push arbitrary notifications to users potentially resulting in phishing spam. While not directly critical, this could create a panic or misdirection of users. Albeit the vulnerable endpoint was not used in production, we would like to payout a good will reward as it was likely we would use it in the future with the bug present.\n\nProposed payout of 1000$ in HDX at ~0.01381 7d Average\n\n","bodyFormat":"markdown","tldr":"","labels":[],"linked":["treasury:19"],"author":{"account":{"accountId":"0xa47e50ce7e52bdf2fccf66c172fae3ec3a0ca0b57716860db9efc38750fddf11","address":"14igNr9LabUkxmMys8CSTqUyJaHWum4bjBCSPqZPgXdmFTPc","emoji":"🐝","tag":null,"identity":{"display":"jak-pan","verified":true,"email":"jakub.panik@gmail.com","web":"","twitter":"@JakPanik"},"profile":null},"legacyName":null},"authority":"subsquare","revision":0,"createdAt":"2025-05-08T17:03:06.000Z","editedAt":null,"lastActivityAt":"2025-05-10T01:57:36.000Z","commentsCount":1,"updatesCount":0,"upvotes":0,"threadKey":"opengov:82","source":{"name":"subsquare","id":"681ce3f7d3d02b83d33b619d","cid":null,"removed":false},"bannerCid":null,"banner":null,"poll":null,"locked":false,"media":{},"hidden":false,"generation":"d9716f164a91ebad"}