3 ms·
Another Security Hole Found On Yelp, Facebook Data Once Again Put At Risk
- gdeglin 16y agoIf anyone is curious, these security holes were found in dynamically generated javascript that included a GET parameter that was neither encoded nor run through magic_quotes. They were easy to find to the point where an automated scanning tool could almost certainly identify them.
- djcapelis 16y agoThank you for the details.
- DCoder 16y agoWell, at least they had to try to find a hole. I've had the pleasure of maintaining a "typical PHP project" - written by someone with no clue about xss, csrf or anything else. It had an admin interface that simply returned the Location: / header to an unauthorized user without exiting. In a publicly accessible /admin folder no less. The owner only wisened up when Yahoo's spider crawled in and followed all the "delete news item" links. Yes, GET links for delete, and DB storing passwords in plain text, isn't that nice.
- farmer_ted 16y agoIs anyone still using Facebook?