- cross-posted to:
- [email protected]
- cross-posted to:
- [email protected]
"One coder added at least two database entries that are visible on the live site and say “this is a joke of a .gov site” and “THESE ‘EXPERTS’ LEFT THEIR DATABASE OPEN -roro.” "
You must log in or register to comment.
Yes. But how?
Here’s an archived version of the article to get past the paywall. The hackers went to the network tab of their browser’s developer console and noticed that the API calls to write to the database weren’t password protected.
Compared with an SQL injection, how sophisticated is this method?
If SQL injection is picking a lock, this is entering through an unlocked door.
Not sophisticated at all, authentication on API routes is way earlier on the security checklist than SQL query sanitisation. This site is amateur work.
