full-disclosure - NASA.GOV SQL Injections

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: jonathan at nuclearelephant.com (Jonathan A. Zdziarski)
Subject: NASA.GOV SQL Injections

> Dont you think that some people in nasa might also be reading this list?

Hmm if I was in the top 1% of the smartest people in the world, I don't
know if I'd have the time to read all the flames and spam that occur on
this list.  They probably have a team of their own computer geniuses
auditing code on a daily basis, at which point it's only a matter of
time before they realize the flaw.

> Just because you can cause a sql error it doesnt necessarily mean you have found a security flaw: it might not be possible to
> exploit it...

Hopefully they haven't given the user any privileged access (to delete, call shell functions, etc.), 
but come on though, if it's possible to inject SQL code there's most likely some way to exploit at least the database.