full-disclosure - [FD] DoS

Open Source and information security mailing list archives

Message-ID: <CAPKwhwueEkWwpL3fRaV0=f57eJTvpxErqW3YdBJi43eK6+PKPA@mail.gmail.com>
Date: Tue, 29 Apr 2014 12:18:33 -0400
From: Scott Arciszewski <scott@...iszewski.me>
To: fulldisclosure@...lists.org
Subject: [FD] DoS - Intuit QuickBase

Vendor: http://quickbase.intuit.com

Intuit QuickBase sells itself as a combination database and business
intelligence tool. Its performance is terrible; however, that doesn't stop
some businesses from using it as the back-end for their apps.

A fun fact that they don't advertise is that they limit every database to
60MB* and charge tens of thousands of dollars for every extra 10 MB.

Thus, any app that relies on QuickBase is vulnerable to an incredibly
Denial of Service attack vector!

Steps to exploit:
1. Find a service that uses QuickBase in lieu of a relational database.
2. Find a feature in the aforementioned service that inserts data into the
database.
3. Write a script that will trigger this data insert a few hundred times
per minue.
4. Wait an hour or two.
5. ???
6. LOSS!

Seriously, if anyone is ever thinking about using QuickBase as a central
database for their business, you're better off with SQL Server (eww).

* Footnote: When I was first learning to program PHP back in 2002, the
MySQL databases provided by my free webhosting provider were limited to 100
MB each.

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives