this post was submitted on 04 Apr 2024
164 points (97.7% liked)

Programmer Humor

19618 readers
1 users here now

Welcome to Programmer Humor!

This is a place where you can post jokes, memes, humor, etc. related to programming!

For sharing awful code theres also Programming Horror.

Rules

founded 1 year ago
MODERATORS
Feyter@programming.dev
anzo@programming.dev
BurningTurtle@programming.dev
pylapp@programming.dev
164
Life Hack (lemm.ee)
submitted 7 months ago by sag@lemm.ee to c/programmer_humor@programming.dev
94 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[โ€“] dan@upvote.au 0 points 7 months ago (1 children)

Secondly, SQL injection is freakishly common and easy.

Do you have any recent examples of major SQL injection holes?

[โ€“] ricecake@sh.itjust.works 1 points 7 months ago* (last edited 7 months ago)

https://www.securityweek.com/millions-of-user-records-stolen-from-65-websites-via-sql-injection-attacks/

https://www.darkreading.com/remote-workforce/critical-security-flaw-wordpress-sql-injection

https://www.tenable.com/blog/cve-2023-48788-critical-fortinet-forticlientems-sql-injection-vulnerability

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a

https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cwe_id=CWE-89&isCpeNameSearch=false

You can fiddle with the nvd search settings to find whatever severity score you like, or filter by execution parameters.

https://nvd.nist.gov/vuln/detail/CVE-2024-1597

That one was a treat when I check under critical, since it's an injection attack that can bypass parameterized query protections for the database driver, which is why "defense in depth" and "always sanitize your fucking inputs" are such key things to remember.

I hope that provided what you're looking for, and maybe increases your awareness of SQL injection. ๐Ÿ˜Š