3 ms·
After an hour of playing around (nothing malicious) yes it is vulnerable, a lot of sites use the same DB structure (which is because they were made by the same
by ibudiallo 13y ago
After an hour of playing around (nothing malicious) yes it is vulnerable, a lot of sites use the same DB structure (which is because they were made by the same people) and passwords are stored in plain text.
So No it is not just syntax error.
- jcrites 13y agoWould you mind sharing an example query string that injects and passes validation? I'd be interested to see what technique enables it to be valid. (It's obvious to me that the site is under high risk since user-provided strings show up in SQL validation errors, which includes the rest of a real query, but simple injections like using ' and " to break out did not work in my few minutes of trying, so I'm interested to learn what worked.)
- ibudiallo 13y agoI will send you a generic example on your email.