CypherX/xAuth — Issue #31: SQL Injection Prevention
Author: Cicadia
Created: 2012-03-05 13:13:29+00:00
State: open

My last post may have disappeared.

It seems as though entering a ' or such can bypass out of the mySQL query statement (Using the online login) and return an error. Someone who is experienced in mySQL queries could possibly break pass the authentication, "SHUTDOWN WITH NOWAIT" the database server (resulting in horrible consequences), or delete tables right from the authentication screen. I have not attempted to prove this due to the implications it can cause, however I suggest that the developers look into this issue I've found.