4 ms·
> But, isn’t cgit basically read-only? So are SELECT statements until little Bobby Tables shows up. Which is to say that SQL injection can be used to turn rea
by drdec 6y ago
> But, isn’t cgit basically read-only?
So are SELECT statements until little Bobby Tables shows up.
Which is to say that SQL injection can be used to turn read-only functionality into write functionality.
Secondly, if you care about who has access to the data, even read-only vulnerabilities can be damaging.
- mbreese 6y agoTrue, but exploiting cgit would be significantly more difficult than a SQL injection. I could only find a handful of CVEs for cgit, and the last one was in 2018 (v 1.2.1)[1]. It involved reading files outside the git tree. That said, it's not the common software to see publicly, so probably hasn't been thoroughly vetted. But I think the point still stands that installing from source isn't going to be a horrible security risk. Similarly though -- It is a mature project without a lot of new features. I don't think there are killer features in master that would make me want to install from source over `apt install cgit` [1] https://www.cvedetails.com/vulnerability-list/vendor_id-15775/product_id-33075/Cgit-Project-Cgit.html https://www.cvedetails.com/vulnerability-list/vendor_id-1577...
- stonesweep 6y agoYou don't know you have a CVE until you have a CVE, it's not hard to find any given story of bugs being found a decade later with high vulnerability scores. https://securityboulevard.com/2020/07/microsoft-patches-17-year-old-windows-vulnerability-with-cve-10-0-score/ https://securityboulevard.com/2020/07/microsoft-patches-17-y...