#1 Trusted Cybersecurity News Platform Followed by 4.50+ million
The Hacker News Logo
Get the Free Newsletter
SaaS Security

Search results for SQL Injection | Breaking Cybersecurity News | The Hacker News

Idea Cellular Web Portal Hacked, Customers Info may be exposed !

Idea Cellular Web Portal Hacked, Customers Info may be exposed !

Aug 20, 2011
Idea Cellular Web Portal Hacked, Customers Info may be exposed ! Again a critical SQL Injection Vulnerability has been discovered by zSecure Team in a high profile web portal. This time it's Ideacellular web portal which compromises the entire site database. Any malicious smart black hats can create much more devastating attacks using this critical flaw such as: complete access to various database's as shown in screen-shots under proof of vulnerability which can later be misused to access various confidential information; complete database dump; possibility of uploading shell (not fully certain) and much more. Target Website :  https://www.ideacellular.com Attack Type : Hidden SQL Injection Vulnerability Database Type :   MySql 5.0.27 Alert Level : Critical Threats : Database Access, Database Dump Credit : zSecure Team     Previous Vulnerability Discolsures:  Dukascopy, Sify, TimesofMoney, Sharekhan Proof of Vulnerability : About the Company Idea is the 3rd largest mobi
LulzSec Leak Sony's Japanese websites Database !

LulzSec Leak Sony's Japanese websites Database !

May 24, 2011
LulzSec Leak Sony's Japanese websites Database ! Update : 10th Attack on Sony -->  Sony Ericsson Got Hacked by Idahca (Lebanese hacker Group) LulzSec Hacking team today Release the Sony's Japanese website Database dump via their Twitter Account. This is the 9th Attack on Sony. This attack is also using SQL Injection method. The vulnerable Links are: SQLi #1: https://www.sonymusic.co.jp/bv/cro-magnons/track.php?item=7419 SQLi #2: https://www.sonymusic.co.jp/bv/kadomatsu/item.php?id=30&item=4490 Database Structure Has been Leaked on a text file via Pastebin.com :  https://pastebin.com/NyEFLbyX LulzSec are the guys who cracked the Fox.com login database , including emails and passwords. Then LulzSec Hack & Leak pointless ATM information also. Last attack on Sony was also using SQL injection, Sony BMG Greece Hack . The attack on Sony are Continues , But still Sony's Security Experts are busy in only making PlayStation Live again. Their other si
How to Accelerate Vendor Risk Assessments in the Age of SaaS Sprawl

How to Accelerate Vendor Risk Assessments in the Age of SaaS Sprawl

Mar 21, 2024SaaS Security / Endpoint Security
In today's digital-first business environment dominated by SaaS applications, organizations increasingly depend on third-party vendors for essential cloud services and software solutions. As more vendors and services are added to the mix, the complexity and potential vulnerabilities within the  SaaS supply chain  snowball quickly. That's why effective vendor risk management (VRM) is a critical strategy in identifying, assessing, and mitigating risks to protect organizational assets and data integrity. Meanwhile, common approaches to vendor risk assessments are too slow and static for the modern world of SaaS. Most organizations have simply adapted their legacy evaluation techniques for on-premise software to apply to SaaS providers. This not only creates massive bottlenecks, but also causes organizations to inadvertently accept far too much risk. To effectively adapt to the realities of modern work, two major aspects need to change: the timeline of initial assessment must shorte
Clop Ransomware Gang Likely Aware of MOVEit Transfer Vulnerability Since 2021

Clop Ransomware Gang Likely Aware of MOVEit Transfer Vulnerability Since 2021

Jun 08, 2023 Ransomware / Zero-Day
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) have published a joint advisory regarding the active exploitation of a  recently disclosed critical flaw  in Progress Software's MOVEit Transfer application to drop ransomware. "The Cl0p Ransomware Gang, also known as TA505, reportedly began exploiting a previously unknown SQL injection vulnerability in Progress Software's managed file transfer (MFT) solution known as MOVEit Transfer," the agencies  said . "Internet-facing MOVEit Transfer web applications were infected with a web shell named LEMURLOOT, which was then used to steal data from underlying MOVEit Transfer databases." The prolific cybercrime gang has since  issued an ultimatum  to several impacted businesses, urging them to get in touch by June 14, 2023, or risk getting all their stolen data published. Microsoft is tracking the activity under the moniker  Lace Tempest  (aka Storm-0950),
cyber security

Automated remediation solutions are crucial for security

websiteWing SecurityShadow IT / SaaS Security
Especially when it comes to securing employees' SaaS usage, don't settle for a longer to-do list. Auto-remediation is key to achieving SaaS security.
Fortnite Flaws Allowed Hackers to Takeover Gamers' Accounts

Fortnite Flaws Allowed Hackers to Takeover Gamers' Accounts

Jan 16, 2019
Check Point researchers have discovered multiple security vulnerabilities in Fortnite, a massively popular online battle game, one of which could have allowed remote attackers to completely takeover player accounts just by tricking users into clicking an unsuspectable link. The reported Fortnite flaws include a SQL injection, cross-site scripting (XSS) bug, a web application firewall bypass issue, and most importantly an OAuth account takeover vulnerability. Full account takeover could be a nightmare, especially for players of such a hugely popular online game that has been played by 80 million users worldwide, and when a good Fortnite account has been sold on eBay for over $50,000. The Fortnite game lets its players log in to their accounts using third-party Single Sign-On (SSO) providers, such as Facebook, Google, Xbox, and PlayStation accounts. According to the researchers, the combination of cross-site scripting (XSS) flaw and a malicious redirect issue on the Epic Games&
What Developers Need to Fight the Battle Against Common Vulnerabilities

What Developers Need to Fight the Battle Against Common Vulnerabilities

Dec 01, 2022 DevSecOps / Secure Coding
Today's threat landscape is constantly evolving, and now more than ever, organizations and businesses in every sector have a critical need to consistently produce and maintain secure software. While some verticals - like the finance industry, for example - have been subject to regulatory and compliance requirements for some time, we are seeing a steady increase in attention on cybersecurity best practices at the highest levels of government, with the US, UK, and Australia all shining very recent light on the need for secure development at every stage of the SDLC.  Despite this, attackers are constantly finding new ways to bypass even the most advanced protections and defenses. For example, many have shifted their focus from delivering malware to instead compromising APIs, or launching targeted attacks  against a supply chain . And while those high-level incidents are happening with much greater frequency, so too are the more simplistic exploits like cross-site scripting and SQL i
Yahoo! Launches Free Web Application Security Scanner

Yahoo! Launches Free Web Application Security Scanner

Sep 26, 2015
Yahoo! has open-sourced Gryffin – a Web Application Security Scanner – in an aim to improve the safety of the Web for everyone. Currently in its beta, Project Gryffin has made available on Github under the BSD-style license that Yahoo! has been using for a number of its open-sourced projects. Gryffin is basically a Go & JavaScript platform that helps system administrators scan URLs for malicious web content and common security vulnerabilities, including SQL Injection and Cross-Site Scripting (XSS) . Yahoo! describes Gryffin as a large-scale Web security scanning platform, which is more than just a scanner, as it is designed to address two specific problems: Coverage Scale Scale is obviously implied for large Web, while Coverage has two dimensions – Crawl and Fuzzing . Crawl's ability is to find as much of the Web application's footprint as possible, whereas Fuzzing involves testing each part of the application's components for an applied se
Old security holes bigger threat, says TrustWave

Old security holes bigger threat, says TrustWave

Oct 30, 2010
An overemphasis on tackling new and emerging security threats may be causing companies to overlook older but far more frequently exploited vulnerabilities, says a recent report. The report, from TrustWave, is based on an analysis of data gathered from over 1900 penetration tests and over 200 data breach investigations conducted on behalf of clients such as American Express, MasterCard, Discover, Visa and several large retailers. The analysis showed is that major global companies are employing "vulnerability chasers" and searching out the latest vulnerabilities and zero-day threats while overlooking the most common ones, the report said. Trustwave buys Breach Security As a result, companies continue to be felled by old and supposedly well understood vulnerabilities rather than by newfangled attack tools and methods. For instance, the top three ways hackers gained initial access to corporate networks in 2009 were via remote acces
Warning: Over 100 Tor Nodes Found Designed to Spy On Deep Web Users

Warning: Over 100 Tor Nodes Found Designed to Spy On Deep Web Users

Jul 26, 2016
Researchers have discovered over 100 malicious nodes on the Tor anonymity network that are "misbehaving" and potentially spying on Dark Web sites that use Tor to mask the identities of their operators. Two researchers, Amirali Sanatinia and Guevara Noubir, from Northwestern University, carried out an experiment on the Tor Network for 72 days and discovered at least 110 malicious Tor Hidden Services Directories (HSDirs) on the network. The nodes, also known as the Tor hidden services directories ( HSDirs ) are servers that act as introductory points and are configured to receive traffic and direct users to hidden services (" .onion " addresses). In other words, the hidden services directory or HSDir is a crucial element needed to mask the true IP address of users on the Tor Network. But, here's the issue: HSDir can be set up by anyone. "Tor's security and anonymity is based on the assumption that the large majority of its relays are honest and
SqlInjector : A MS SQL Server Blind Injector !

SqlInjector : A MS SQL Server Blind Injector !

Nov 07, 2010
SqlInjector  was originally called as BlindSQLInjector. SqlInjector is an application  to perform completely blind SQL injection, that currently supports only MS SQL Server. It uses time based inference to determine true  or false conditions to extract data. The key feature is that it uses a binary search mechanism to reduce the character search address space, this means it can get each character value within 7 to 8 requests. A simple screenshot: Its features are: Ability to export data Binary search for faster character identification Completely blind injection using time based inference True/False inference Supports MS SQL Server Extracts database name Extracts current user Extracts server version Extracts table names Extracts column names Extracts column data types Extracts column lengths Configurable space encoding Configurable wait timing Tree view display of enumerated data Resume support Save/Loading of project files Proxy support Authentication
Siemens and Canon's Databases exploited by Team INTRA

Siemens and Canon's Databases exploited by Team INTRA

Mar 01, 2012
Siemens and Canon 's Databases exploited by Team INTRA Recently a hacker known as " JoinSe7en " from Team INTRA claims to have hacked into subdomains of Canon and Siemens. Apparently, the hacker has found and exploited a Blind SQL Injection vulnerability in Canon's website and a Error based SQL Injection in Siemens. He published a full disclosure on both of the databases on pastebin: Siemens : https://pastebin.com/HBL966wh Canon : https://pastebin.com/fbL0s9aS These pastebin notes include the vulnerable links of respective sites and extracted database info with usernames and passwords of Siemens Users & Canon forum, sites user credentials.
SQL Injection Vulnerability in Italian Government's website !

SQL Injection Vulnerability in Italian Government's website !

Jan 08, 2011
 SQL Injection Vulnerability in Italian Government 's website ! Site Penetrate By : God_Of_Pain , Lord TittiS , SYSTEM_OVERIDE                           [ 1] Site And Server Info # Website link :  https://governo.it/ # Bug Url:  Can't Publish # Powered By: ASP.NET # Server Detail: Microsoft SQL Server  2000 - 8.00.2039 (Intel X86)  # Server Name: WEB-VSQL1\INST1 # Current DB: chigi_intranet # Database : MSSQL 2005 * [2] SQL Detail # Databases List:       - chigi_intranet              - master              - tempdb              - model (LOCKED)              - msdb              - AAA (LOCKED)              - chigi_mag2006              - chigi_intranet              - chigi_developer              - sondaggidb (LOCKED)              - AffariRegionali_BO (LOCKED) # Tables of 3 DB: [+] chigi_intranet: doc_tipi  qst_datipersonali  doc_target  doc_prov_tipi  eml_scrivi_a  doc_prov_aree  doc_monitoraggio_soggetto  eml_categoria  doc_monitoraggio_
Cybersecurity Resources