Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • World
  • Users
  • Groups
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse
Code Project
  1. Home
  2. Other Discussions
  3. The Weird and The Wonderful
  4. why o' why?

why o' why?

Scheduled Pinned Locked Moved The Weird and The Wonderful
question
25 Posts 16 Posters 0 Views 1 Watching
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • C Chris Maunder

    All you've got are table names (and for the movie table only) - you can't actually get access. It's dumb and stupid but not a humungous breach

    cheers, Chris Maunder

    CodeProject.com : C++ MVP

    D Offline
    D Offline
    Draugnar
    wrote on last edited by
    #21

    As has already been pointed out... We now know that they use inline SQL, so the first input page you come too makes it ripe to do the injection attack with a 'drop tables' in it.

    1 Reply Last reply
    0
    • P Paul Conrad

      Bad code behind, I guess...

      "The clue train passed his station without stopping." - John Simmons / outlaw programmer

      D Offline
      D Offline
      Draugnar
      wrote on last edited by
      #22

      It's inline server tags, not code behind. And, in fact, their other pages are in classic ASP, not ASP.NET (extension is .asp, not .aspx)

      1 Reply Last reply
      0
      • P Pete OHanlon

        Sweet. SQL Injection attack anyone? :rolleyes:

        Deja View - the feeling that you've seen this post before.

        My blog | My articles

        D Offline
        D Offline
        Draugnar
        wrote on last edited by
        #23

        Here's a URL for an intrepid deconstructionist to hack out. http://www.shringar.co.in/pressroom/newsdetails.asp?press_id={B5079EAA-06FA-4D6A-8E82-688BAE7E665E}[^]

        1 Reply Last reply
        0
        • P Paul Conrad

          Pete O'Hanlon wrote:

          SQL Injection attack anyone?

          Totally. Think of any good ones? :rolleyes:

          "The clue train passed his station without stopping." - John Simmons / outlaw programmer

          P Offline
          P Offline
          Pete OHanlon
          wrote on last edited by
          #24

          Paul Conrad wrote:

          Totally. Think of any good ones?

          :laugh: It does sound a bit "Capture the flag"

          Deja View - the feeling that you've seen this post before.

          My blog | My articles

          1 Reply Last reply
          0
          • N ne0h

            Open this below link in Firefox and look at the top of the page! click[^]


            "hi, I am explorer.exe. sometimes when you are doing anything at all, I will just freeze for ten minutes. All of my brother and sister windows will also freeze, because they are sad for me. Maybe we will come back, maybe not, it will be a surprise!"

            M Offline
            M Offline
            Mabre of the Tadadas
            wrote on last edited by
            #25

            This points out another coding horror/problem (whatever). It gets past IE 7. Sad but yes IE 7 lets it past while Opera and Firefox don't. The most we can hope is that IE 7 was made to ignore the problem. I seen a page where the title is in the body instead of the header so it is shown on the actual page.

            1 Reply Last reply
            0
            Reply
            • Reply as topic
            Log in to reply
            • Oldest to Newest
            • Newest to Oldest
            • Most Votes


            • Login

            • Don't have an account? Register

            • Login or register to search.
            • First post
              Last post
            0
            • Categories
            • Recent
            • Tags
            • Popular
            • World
            • Users
            • Groups