Sun 27 Mar 2011
MySQL.com Database Compromised By Blind SQL Injection
Posted by Slavik under breach, SQL injection
1 Comment
I guess this is somewhat ironical. At least it was nothing simple as in-band SQL Injection via errors or directly. It just goes to show you that any site can be vulnerable to attacks, even guys that write DB engines for a living. On the other hand, I’m sure that the sites were not created by the same guys who work on the database.
The answer to SQL Injection is very simple – use BIND VARIABLES, for Pete’s sake. It will cover 99% of your use-cases and for the other 1%, consider the security implications!
One Response to “ MySQL.com Database Compromised By Blind SQL Injection ”
Trackbacks & Pingbacks:
[...] red team for providing the material and Andy for doing the proofing and adding his words of wisdom. As always, the simple way to solve SQL injection is to use bind [...]