Filed Under: php, programming
So, just when i thought i had seen it all… this is the REQUEST, as captured by Fiddler.
Yes, you read that right… the SWF builds the request and sends it through to the web server; in plain text.
(i’ve modified the actual contents of the SQL, naturally)
POST /flashsql.php?id=106 HTTP/1.1
= QUERYSTRING ====
id=106
= BODY ====
host=NNN.NNN.NN.NN
sql_=SELECT DISTINCT( id ), name, filename FROM table LEFT
JOIN table2 ON ( id = id ) LEFT JOIN
table3 ON ( id = id ) LEFT JOIN table4 ON
( id = id ) LEFT JOIN table5 ON ( id = id ) WHERE id IN(155,150,52,149,134,133,76) AND
typeId=9 ORDER BY id
dat=databasename
5 tables, no less and a database name. And a file on the server that happily accepts any SQL for execution. Oh, and this was an e-commerce website.
They were notified and they have subsequently made things a lot more secure.
Subscribe to comments feed (this is global, not just for this entry)
The time has come, the Walrus said… Not moving very far, but consolidating the technology and personal ranting all into one uber blog. New location (location, location, location) is http://bryanallott.net/blog/. Updated feed URL (http://feeds.feedburner.com/bryanallottnet)
I say “industry” but there’s no real regulation put in by the government (at least here) which keeps the industry in check. For one, it’s not illegal to provide IT services or build software without a licence, while in more established industries, it is illegal to, for example, provide medical, financial, engineering or manufacturing services […]