To be honest... |
||
 Lt Obscurity You're logic is FAR from flawed, and it's completely viable. I've seen Security Patches punched out for far less then that. And again, to be honest, I think of it as a rather 'script-kiddie' exploit (no offense, see my explenation after this). I see it as this: A script kiddie can go to Security Focus, read one of their SQL Injection articles on Blind-Side Injection, read Sam's SQL in 10 minutes guide, figure out what the table names are. Then bam, he posts his specially crafted query, and you have a huge mess of a compromise. So essentially you have a rather heavy vulnerability, and possible compromise of the entire database. Damn... You should E-Picket their PHPbb's E-Front Doors :) But seriously, how hard is it going to be to convince them? Catch me on CAIRC
Replies:
|
||
| CyberArmy::Forum v0.6 Generated In 0.01064 seconds |
2004-03-22 04:23:47
2004-03-25 16:48:09
2004-03-23 11:00:34
2004-03-23 11:16:40
2004-03-23 09:25:26