Finding an authorization bypass on my own website

Re:Finding an authorization bypass on my own website by andreareina on Saturday March 05, 2022 @06:48PM (#30573235)

Other rdbms have identifier quoting, yes. But the problem isn't that identifier quoting exists, it's that the library interprets an object as a key = value statement (compounded treating the key as an identifier), which it shouldn't.

    ... AND password = password = 1

is just wrong, quoted or not.

[ Parent | on HN ]

Re:Finding an authorization bypass on my own website by yawaramin on Saturday March 05, 2022 @11:58PM (#30575154)

Also, the fact that the library doesn't validate the type of the input data ({password: 1} when the password should be a string...).

This is just a cascading chain of failures.

[ Parent | on HN ]