Pro-Trump social media app hacked on launch day as half million sign up

Re:Pro-Trump social media app hacked on launch day as half m... by kyrra on Monday July 05, 2021 @09:26AM (#27737748)

What was wrong with that change that allowed them to get hacked?

Edit, can I guess that this isn't how to do proper sql parameterized input?

> s.account_id = #{@id}

I don't know ruby at all...

[ Parent | on HN ]

Re:Pro-Trump social media app hacked on launch day as half m... by rsynnott on Monday July 05, 2021 @09:38AM (#27737842)

Something along the lines of

"https://thewebsite.com/the_url?max_id=); DROP TABLE orange_face_paint ; [.. make the remainder valid sql here]"

I would think. Essentially, it allows user-provided input to do anything; it's the most trivial form of SQL injection vulnerability.

[ Parent | on HN ]