Download as PDF, PPTX
Uploaded byMathias Karlsson
PDF, PPTX1,475 views
SQL Injection INSERT ON DUPLICATE KEY trick
The document discusses a security issue involving a login system where an SQL injection vulnerability allows the attacker to change the admin's password to the same as that of a regular user. It references a lightning talk by Mathias Karlsson, highlighting that SQL injection during insertion can be more severe than during selection. Overall, it emphasizes the importance of securing applications against such vulnerabilities.
SQL Injection INSERT ON DUPLICATE KEY trick
- 2. • Login • Register •View article • Admin • Bcrypt, so couldn't get into admin panel :((
- 3.
- 4.
- 6. Password of user'admin' is now the same as password of user 'attacker'!
- 7. SQL Injection inINSERT is sometimes worse than SQL injection in SELECT Lightning talk by @avlidienbrunn (Mathias Karlsson)