5 ms·
Not unsurprisingly, x' AND email IS NULL; -- works as the username with no password. Injection FTL.
by throwaway212121 16y ago
Not unsurprisingly, x' AND email IS NULL; -- works as the username with no password. Injection FTL.
- lloeki 16y agoSo much for the security change. I thought that kind of injection was really a thing of the past. Injection is the web segfault.
- FaceKicker 16y agoGood find, though I don't think most of it is necessary. It seems like any username that includes a semicolon at any point will authenticate. I can't imagine what their code would have to look like in order for that to happen.
- pavel_lishin 16y agoEspecially considering they're actually paying monthly for it. http://news.ycombinator.com/item?id=2330694 http://news.ycombinator.com/item?id=2330694