| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 29 Apr 2014 12:18:33 -0400 From: Scott Arciszewski <scott@...iszewski.me> To: fulldisclosure@...lists.org Subject: [FD] DoS - Intuit QuickBase Vendor: http://quickbase.intuit.com Intuit QuickBase sells itself as a combination database and business intelligence tool. Its performance is terrible; however, that doesn't stop some businesses from using it as the back-end for their apps. A fun fact that they don't advertise is that they limit every database to 60MB* and charge tens of thousands of dollars for every extra 10 MB. Thus, any app that relies on QuickBase is vulnerable to an incredibly Denial of Service attack vector! Steps to exploit: 1. Find a service that uses QuickBase in lieu of a relational database. 2. Find a feature in the aforementioned service that inserts data into the database. 3. Write a script that will trigger this data insert a few hundred times per minue. 4. Wait an hour or two. 5. ??? 6. LOSS! Seriously, if anyone is ever thinking about using QuickBase as a central database for their business, you're better off with SQL Server (eww). * Footnote: When I was first learning to program PHP back in 2002, the MySQL databases provided by my free webhosting provider were limited to 100 MB each. _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists