3 ms·
Interesting, sqli that works only for reading encrypted_hash from DB? But since password is unique it cannot be bruteforced even locally.
by homakov 11y ago
Interesting, sqli that works only for reading encrypted_hash from DB? But since password is unique it cannot be bruteforced even locally.
- bigiain 11y agoTrue - it's the (many many documented[1]) cases where the SQLi grabs the password_cleartext column, not the encrypted_hash one that worry me here. [1] http://plaintextoffenders.com/ http://plaintextoffenders.com/