3 ms·
I was mostly shocked by the following sentence: > The authors were initially reluctant to acknowledge the CSRF issue, but after obtaining a second opinion from
by Deukhoofd 5y ago
I was mostly shocked by the following sentence:
> The authors were initially reluctant to acknowledge the CSRF issue, but after obtaining a second opinion from the WordPress plugin team, they fixed it in version 0.9.5.
In what world do you get notified there's a possibility for SQL injection in your code, and then not immediately fix it? This statement shows such arrogance, and little regard for the security of users.
- hluska 5y agoYeah…the poor researcher had to make a video to show off the CSRF attack. First off, that researcher really should never pay for another beverage again. Second, the arrogance, holy shit the arrogance. Dude here managed to consistently write SQLi vulnerabilities over multiple releases - he’s really not in the place to argue.
- Doctor_Fegg 5y agoNot defending this at all, but "CSRF issue" != SQL injection.