“Rewriting the laws” of a British Overseas territory with SQL Injection

How this security vulnerability could let anyone “rewrite the laws” of HM Government of Gibraltar.

Ax Sharma
AxDB

--

The Rock of Gibraltar — Photo by Michal Mrozek on Unsplash

Note: As of publishing this article, the vulnerable sections of the website have been shut down, effectively resolving the vulnerability. Special thanks to Gareth Corfield of The Register for coordinating with the responsible disclosure.

“Do UK residents need a visa to visit Gibraltar,” was what I needed an answer to, which is why I stumbled upon Gibraltar’s Borders and Coastguard Agency website. Being a British Overseas Territory, Gibraltar falls sort of under the jurisdiction of the UK, yet has its own government and laws so it’s a bit confusing. My intention at around 11 o’ clock at night was to clarify just that — and get a solid goodnight’s sleep. Little did I realise this would turn into a long night of exploration.

The Borders and Coastguard Agency website had an outlink to Gibraltar Immigration Act, which looked like…

--

--