Full Disclosure mailing list archives

NASA.GOV SQL Injections

From: "Lorenzo Hernandez Garcia-Hierro" <lorenzohgh () nsrg-security com>
Date: Wed, 15 Oct 2003 01:45:02 +0200

Hi all again,
http://liftoff.msfc.nasa.gov/toc.asp?s=Tracking&apos;
admits sql characters injection but seems not easy to include successful
queries
security of nasa websites sucks ( sucks the web app security...)
best regards,
-------------------------------
0x00->Lorenzo Hernandez Garcia-Hierro
0x01->/* not csh but sh */
0x02->$ PATH=pretending!/usr/ucb/which sense
0x03-> no sense in pretending!
__________________________________
PGP: Keyfingerprint
4ACC D892 05F9 74F1 F453  7D62 6B4E B53E 9180 5F5B
ID: 0x91805F5B
**********************************
No Secure Root Group Security Research Team
http://www.nsrg-security.com
______________________


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Current thread:

NASA.GOV SQL Injections Lorenzo Hernandez Garcia-Hierro (Oct 14)
- Re: NASA.GOV SQL Injections mcbethh (Oct 16)
  - RE: NASA.GOV SQL Injections Russ Spooner (Oct 17)
    - RE: NASA.GOV SQL Injections Jonathan A. Zdziarski (Oct 17)
- <Possible follow-ups>
- RE: NASA.GOV SQL Injections Schmehl, Paul L (Oct 17)
  - RE: NASA.GOV SQL Injections Jonathan A. Zdziarski (Oct 17)
    - RE: NASA.GOV SQL Injections Ron DuFresne (Oct 17)
    - RE: NASA.GOV SQL Injections Jonathan A. Zdziarski (Oct 17)
    - RE: NASA.GOV SQL Injections Ron DuFresne (Oct 17)
    - RE: NASA.GOV SQL Injections madsaxon (Oct 17)
    - Re: NASA.GOV SQL Injections Gregory A. Gilliss (Oct 17)

(Thread continues...)