News for hackers. Stuff that matters.

A comment on Malls Aren't Dying, They're Thriving.

Re:Malls Aren't Dying, They're Thriving by Yhippa on Monday June 08, 2015 @07:47PM (#9683219) 

  Warning: User 'newgeog_todbot' has exceeded the 'max_questions' resource (current value: 720000) query: SELECT CASE WHEN status=1 THEN 0 ELSE 1 END FROM access WHERE type = 'host' AND LOWER('96.89.0.129') LIKE LOWER(mask) ORDER BY status DESC LIMIT 0, 1 in /home/newgeog/public_html/includes/database.mysql.inc on line 172
Exposing your SQL queries in an exception on a public-facing website does not seem like a best practice.
[ Parent | on HN ]
Re:Malls Aren't Dying, They're Thriving by mcantelon on Monday June 08, 2015 @07:50PM (#9683230)
Their file paths too. Looks like they're running Drupal by the tables.

EDIT: Yup, Drupal 5.7 seemingly (old, likely security issues). http://www.newgeography.com/CHANGELOG.txt

[ Parent | on HN ]
Re:Malls Aren't Dying, They're Thriving by dragonwriter on Monday June 08, 2015 @07:52PM (#9683240)
From a UX POV, probably not.

If this is a security complaint, well, its less exposed information (a strict subset) than if your app was open source, so I don't see it as particularly a problem.

[ Parent | on HN ]
Re:Malls Aren't Dying, They're Thriving by viraptor on Monday June 08, 2015 @08:04PM (#9683293)
Actually it's not a subset. Even if the app is open source, what you gain from this error is: username, installation path, resource limits. All of those add something you don't know from the code itself. All can be useful when trying (respectively) injections / bruteforce auth, path traversal / secrets access, denial of service.

Also line numbers can help you identify the deployed version.

Also optional table prefixes which are deployment-specific.

[ Parent | on HN ]
Re:Malls Aren't Dying, They're Thriving by dragonwriter on Monday June 08, 2015 @11:52PM (#9683978)
You're right, I was wrong; leaving the grandparent post just for context for your response, otherwise I'd delete it.
[ Parent | on HN ]
Re:Malls Aren't Dying, They're Thriving by __z on Monday June 08, 2015 @10:20PM (#9683731)
Information leakage is considered a security vulnerability. https://www.owasp.org/index.php/Information_Leakage
[ Parent | on HN ]