RE: NASA.GOV SQL Injections

["Jonathan A. Zdziarski" <jonathan () nuclearelephant com>]

> Dont you think that some people in nasa might also be reading this list?

Hmm if I was in the top 1% of the smartest people in the world, I don't
know if I'd have the time to read all the flames and spam that occur on
this list.  They probably have a team of their own computer geniuses
auditing code on a daily basis, at which point it's only a matter of
time before they realize the flaw.

> Just because you can cause a sql error it doesnt necessarily mean you have found a security flaw: it might not be 
> possible to
> exploit it...

Hopefully they haven't given the user any privileged access (to delete, call shell functions, etc.), 
but come on though, if it's possible to inject SQL code there's most likely some way to exploit at least the database.


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html