SQL injection search • Hacker News Board

Re: SQL injection search

#111

Post by diminoten » Mon, Jun 03, 2013, 12:44 AM UTC

pointyhats wrote: post #50

diminoten wrote: post #38

There is a huge need in the space for a well marketed quality assurance contractor who can find problems like this and fix them. "We found these issues, and we can fix them all. Pay us for finding them or pay us some more for fixing them, too." sort of thing. Why don't you see QA shops popping up like this?

There are loads of companies already doing this, at least in the UK. They find the holes and you fix them.

The space is dominated by security oriented companies. Bugs are oftentimes not security issues though.

Re: SQL injection search

#112

Post by Nodex » Mon, Jun 03, 2013, 7:41 AM UTC

postfuturist wrote: post #62

This isn't a search for SQL injection, its a search for a couple things that you often find in older PHP code that is generally hacked together and likely to have SQL injection vulnerabilities for historical and cultural reasons. However it's perfectly easy to avoid SQL injection even using these things. $id = mysql_real_escape_string($_GET['id']); $res = mysql_query("SELECT foo FROM bar WHERE id='$id'"); That may be…

That is NOT bulletproof.

Re: SQL injection search

#113

Post by btipling » Mon, Jun 03, 2013, 12:31 PM UTC

gingerlime wrote: post #102

btipling wrote: post #78

Earlier quoted context omitted.

Those all look like XSS vulnerabilities to me.

Of course this is a pretty good starting point to find XSS, but I still see quite a few false positives: the first result I see currently: https://github.com/matsprehn/122B/blob/1d54d2a72f25a23d63ff7... also spotted this, which looks pretty harmless: https://github.com/cameroni2003/picgrid/blob/0b3becda1f250ef... a lot others look similar, plus it depends on context...

Yes, sure. Those two do not reveal vulnerabilities just from the results, but I have to wonder at not using templates on the first.

Re: SQL injection search

#114

Post by muloka » Fri, Jun 07, 2013, 4:32 PM UTC

jarofgreen wrote: post #99

orangethirty wrote: post #24

Looking around I found a simple CMS sold to small online stores. Through their links you can find a listing of their customers (people who use their CMS). Problem is the CMS is open to SQL injection everywhere. If a script kiddie found this info they could take down a lot of online stores. Not good.

Did you tell them?

Or better yet write a patch and submit a pull request informing them.