Security Basics mailing list archives
Re: about SQL injection
From: Steven DeFord <security.willworker () gmail com>
Date: Mon, 4 Apr 2005 17:15:31 -0700
On Apr 3, 2005 6:07 AM, Seung Hyun Cho <s970501 () gmail com> wrote:
I've found vulnerabilities in some pages. exploited query is working like... "select * from xxx where id=3" when I put something like '2 or 1=1', it shows every data in xxx.
Well, the canonical example is 2; drop database which has obvious downsides. Also, if your table contains any sensitive information, bad people seeing it is, obviously, a problem. -- Steven DeFord Security.Willworker () gmail com (925) 596-0426 --------------------------------------------------------------------------- Earn your MS in Information Security ONLINE Organizations worldwide are in need of highly qualified information security professionals. Norwich University is fulfilling this demand with its MS in Information Security offered online. Recognized by the NSA as an academically excellent program, NU offers you the opportunity to earn your degree without disrupting your home or work life. http://www.msia.norwich.edu/secfocus_en ----------------------------------------------------------------------------
Current thread:
- about SQL injection Seung Hyun Cho (Apr 04)
- Re: about SQL injection Steven DeFord (Apr 05)
- RE: about SQL injection choongseng (Apr 05)
- Re: about SQL injection Kevin Carlson (Apr 05)
- Re: about SQL injection David MacDonald (Apr 05)
- Re: about SQL injection Mert Eren ÜSTÜNKAYA (Apr 06)
- <Possible follow-ups>
- Re: about SQL injection Jeffrey (Apr 05)