From af0dca299e58ae11bbd97f4599b827cde12c06ce Mon Sep 17 00:00:00 2001
From: Tamir Gershberg <47638346+tamirGer@users.noreply.github.com>
Date: Tue, 12 Mar 2024 02:01:43 +0200
Subject: [PATCH] feat(date_manipulation): update readme

---
 README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/README.md b/README.md
index 1397e061..ad334019 100644
--- a/README.md
+++ b/README.md
@@ -150,3 +150,5 @@ Additionally, the endpoint PUT /api/users/one/{email}/photo accepts SVG images,
   2. The endpoint GET `/api/partners/searchPartners` is supposed to search partners' names by a given keyword. It's vulnerable to an XPATH injection using string detection payloads. When exploited, it can grant access to sensitive information like passwords and even lead to full data leak. You can use `')] | //password%00//` or `')] | //* | a[('` to exploit the EP.
   3. The endpoint GET `/api/partners/query` is a raw XPATH injection endpoint. You can put whatever you like there. It is not referenced in the frontend, but it is an exposed API endpoint.
   4. Note: All endpoints are vulnerable to error based payloads.
+
+* **Date Manipulation** - The `/api/products?date_from={df}&date_to={dt}` endpoint fetches all products that were created between the selected dates. There is no limit on the range of dates and when a user tries to query a range larger than 2 years querying takes a significant amount of time. This EP is used by the frontend in the `/marketplace` page.