Researchers found several points of entry for potential attackers, one of which was Apple’s Book Travel portal, where they took advantage of a significant SQL injection vulnerability. Experimenting with the Masa/Mura CMS revealed the attack surface, primarily the one available within Apple’s environment.  The JSON API was the main focus because it provides access to certain functions available within Apple’s environment.

Source: GBHackers