sql inject on nm.debian.org

To: debian-www@lists.debian.org
Cc: security@debian.org
Subject: sql inject on nm.debian.org
From: Ferenc Kovacs <tyra3l@gmail.com>
Date: Mon, 20 Feb 2012 12:30:29 +0100
Message-id: <[🔎] CAH-PCH74+fa4sEKj13HdfTZiEb-MLnmPaUXuADxxkQVAdqfWMw@mail.gmail.com>

https://nm.debian.org/nmstatus.php?email='"
produces
Problem with queryERROR: unterminated quoted identifier at or near ""asd'" LINE 1: SELECT * from applicant WHERE email=''"' ^

--
Ferenc Kovács
@Tyr43l - http://tyrael.hu

Reply to:

Follow-Ups:
- Re: sql inject on nm.debian.org
  - From: Simon Paillard <spaillard@debian.org>

Prev by Date: packages.debian.org: no package description for gargoyle-free
Next by Date: Re: sql inject on nm.debian.org
Previous by thread: packages.debian.org: no package description for gargoyle-free
Next by thread: Re: sql inject on nm.debian.org
Index(es):
- Date
- Thread