On Thu, 2010-04-29 at 08:49 +1000, Ross McKay wrote:
On Wed, 28 Apr 2010 16:54:56 -0400, David Stoltz wrote:
[...]
We recently have added a very small web application that is vendor
supported. They said it's not working, so I investigated. I found that
our software protection was blocking their pages because they are
actually passing entire SQL queries in their form POSTs. Now, the app is
SSL protected, and they claim the queries are not executed - only
inserted into the database to be used later. They also said it's
protected by the ASP.NET framework authentication [...]
Unless they're storing the SQL queries so that they can show them later
on, e.g. as text in a forum post, I think you have a major WTF on your
hands! Please submit here!
http://thedailywtf.com/Contact.aspx
:)
--
Ross McKay, Toronto, NSW Australia
The chief cause of problems is solutions -Eric Sevareid
You could always try crafting your own query and attempt to insert
something of your own. If they complain after that you've broke their
system, you'll be able to tell them that it really wasn't that secure in
the first place.
Thanks,
Ash
http://www.ashleysheridan.co.uk
