Vulnerability
vulnerability:sql_injection_vulnerability
Web-application vulnerability that allowed w0rmer to access underlying police-department databases.
A web-application weakness caused by improperly sanitized input, allowing database queries through a login field.
“The website was not sanitizing its user inputs properly and he could issue SQL commands”
“rockyou.com was vulnerable to a SQL injection”
Web-application vulnerability that allowed w0rmer to access underlying police-department databases.
“the website was vulnerable to SQL injections, a common vulnerability on many websites”
A vulnerability in the Marketwire website that allowed database manipulation and access to stored press releases.
“the website was vulnerable to SQL injection attacks”
A web-application vulnerability described as allowing Hieu to access databases and customer information.
“it got a SQL injection vulnerability”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | DISCOVERED_BY | Imperva | Explicit | 33 |
| incoming | EXPLOITS | Tom | Explicit | 33 |
| incoming | INVOLVES | RockYou | Explicit | 33 |
| incoming | INITIAL_ACCESS_VIA | West Virginia Police Department website hack | Explicit | 63 |
| incoming | EXPLOITS | Higinio Ochoa | Explicit | 63 |
| incoming | INITIAL_ACCESS_VIA | Alabama Department of Public Safety website hack | Attributed | 63 |
| incoming | INITIAL_ACCESS_VIA | Texas Department of Public Safety website hack | Attributed | 63 |
| incoming | EXPLOITS | Ivan Turchynov | Explicit | 123 |
| incoming | EXPLOITS | Hieu Minh Ngo | Explicit | 162 |
Tom EXPLOITS SQL injection vulnerability
Tom tested websites for SQL injection and exploited the vulnerability in csfd.cz and later rockyou.com.
Explicit Confidence 99% · Jack Rhysider EP 33 Details
“Tom saw this website was vulnerable to SQL injection and started seeing what kind of fun he could have.”
“He immediately started checking for himself and sure enough he was able to get right in”
RockYou INVOLVES SQL injection vulnerability
The breach involved RockYou's SQL injection vulnerability, which was later fixed after notification.
Explicit Confidence 99% · Jack Rhysider EP 33 Details
“They worked all weekend to resolve this SQL injection on their site”
SQL injection vulnerability DISCOVERED_BY Imperva
A security researcher at Imperva identified the SQL injection vulnerability and notified RockYou.
Explicit Confidence 93% · Jack Rhysider EP 33 Details
“He notified RockYou of this vulnerability”
West Virginia Police Department website hack INITIAL_ACCESS_VIA SQL injection vulnerability
The West Virginia police website was entered through an SQL injection vulnerability.
Explicit Confidence 99% · Jack Rhysider EP 63 Details
“He found the website was vulnerable to SQL injections”
“he hacked into the West Virginia Police Department’s website using an SQL injection”
Higinio Ochoa EXPLOITS SQL injection vulnerability
Jack says w0rmer exploited an SQL injection vulnerability to enter the West Virginia police website.
Explicit Confidence 99% · Jack Rhysider EP 63 Details
“he hacked into the West Virginia Police Department’s website using an SQL injection”
Alabama Department of Public Safety website hack INITIAL_ACCESS_VIA SQL injection vulnerability
The FBI later treated the Alabama hack as using the same SQL injection vulnerability as the other police website hacks.
Attributed Confidence 90% · Jack Rhysider EP 63 Details
“To the FBI this all looked like it was exploiting the same SQL injection vulnerability.”
Texas Department of Public Safety website hack INITIAL_ACCESS_VIA SQL injection vulnerability
The FBI associated the Texas hack with the same SQL injection vulnerability used in the other police department hacks.
Attributed Confidence 89% · Jack Rhysider EP 63 Details
“To the FBI this all looked like it was exploiting the same SQL injection vulnerability.”
Ivan Turchynov EXPLOITS SQL injection vulnerability
Ivan exploited a SQL injection vulnerability in the Marketwire website after scanning it for weaknesses.
Explicit Confidence 99% · Jack Rhysider EP 123 Details
“He scanned the website looking for a vulnerability, and found the website was vulnerable to SQL injection attacks.”
Hieu Minh Ngo EXPLOITS SQL injection vulnerability
Hieu exploited SQL injection vulnerabilities in e-commerce sites and data brokers.
Explicit Confidence 99% · Hieu Minh Ngo EP 162 Details
“that website, it got a SQL injection vulnerability”
“First; SQL injection”