aka.. Someone put the hurtski on Kaspersky..

The Twitters (via XSSniper and others) and the Interwebs were ablaze with news on a SQL Injection vulnerability that was exploited on AV vendor Kaspersky’s site. Detail of the attack can be found here.

It’s interesting that SQL Injection (though as old as the proverbial hills) is still such a major issue.
In fact, I have it on good authority that the bulk of PCI-related compromises are still as a result of SQL Injection…

In our own work, we see this all over the show.

Also interesting is the fact that the DB in use by Kaspersky is MySQL – so much for the “I don’t use MSSQL, I have x database with magical pixie dust SQL Injection protection – what me worry?” argument…

Once again, security one-oh-one…if you aren’t *effectively* validating user input, you’re going to get bitten some time…

/nick

ED* From the shameless self promotion department:

haroon and Marco have just finished their chapters in an upcoming book dedicated to SQL Injection. We will post more details here when its available. (the book aims to give SQL Injection thorough coverage from OR 1=1 to some of the insanity demo’d at BlackHat last year..)