|
The Web Hacking Incidents Database
Last update:07 November 2007
List of incidents of class SQL Injection
Other
WASC threat
classifications:
Abuse of Functionality, Brute Force, Content Spoofing, Credential/Session Prediction, Cross-site Scripting, Defacement, Denial of Service, Directory Indexing, HTTP Response Splitting, Information Leakage, Insufficient Anti-automation, Insufficient Authentication, Insufficient Authorization, Insufficient Process Validation, Insufficient Session Expiration, Known Vulnerabity, Misconfiguration, OS Commanding, Other, Path Traversal, Phishing, Predictable Resource Location, Redirection, SQL Injection, Unknown, Weak Password Recovery Validation, Worm
There are 26 incidents of class SQL Injection
Date: 10 October 2007
Incident Type: Security Breach
WASC Threat Classification: SQL Injection
3,000 records were exposed and 20 actually stolen at Commerce Bank, a small bank in Central USA. While the vulnerability exploited is not clear, SQL injection was mentioned. Therefore the record is uncertain and based on further information, it might be withdrawn.
References:
Date: 30 September 2007
Incident Type: Security Breach
WASC Threat Classification: SQL Injection
The web servers of Scarborough & Tweed, a company that does business online selling corporate gifts online, were compromised and information about 570 customers may have been accessed using an SQL injection attack. The information includes customers' names, addresses, telephone numbers, account numbers, and credit card numbers.
References:
Date: 12 August 2007
Incident Type: Security Breach
WASC Threat Classification: SQL Injection
Defacements are usually beyond the scope of the Web Hacking Incidents Database. We only publish those that stand out, and this one certainly stands out.
The site of the United Nations was broken into and defaced using a pretty basic SQL injection technique, and the referenced article has all the details
References:
Date: 07 August 2007
Incident Type: Security Breach
WASC Threat Classification: OS Commanding, SQL Injection
This gem is very interesting since it happened on Gentoo servers. It therefore combines transparency into the incident that only an open source project can offer with the importance and resource of a large one. As a result we have a detailed report about the vulnerability, exploit attempts and event people shouting at each other during the patching process.
What can we learn from this? That no server is secure, and that patching is hard.
References:
Date: 27 June 2007
Incident Type: Security Breach
WASC Threat Classification: SQL Injection
Yet another defacement, but with a very high profile target, and a detailed description of the attack which took advantage of an SQL injection vulnerability. The report even includes a video recording of the attack.
References:
Date: 10 May 2007
Incident Type: Security Breach
WASC Threat Classification: SQL Injection
Private Bay is a BitTorrent information exchange blog site. Hackers used an SQL Injection vulnerability in the web site to steal 1.6 million users and passwords of the site. At least the passwords where hashed, which means that the hacker would need a cracking software and only the lame passwords will be found.
This incident highlights the Web authentication problem. Just think how many of those users use the same username and password in many other sites.
References:
Date: 08 May 2007
Incident Type: Security Breach
WASC Threat Classification: SQL Injection
A report within the help desk system used to track the status of open service calls created a file that was a accessible to everyone. A hacker abused the problem to get information regarding 22,000 current and former students.
References:
Date: 02 March 2007
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Cross-site Scripting, SQL Injection
While vulnerabilities in public web sites are dime a dozen this days and rarely included in WHID, a classic SQL injection in the login form on the home page of the web site of a very big company is worth an entry. In my presentation I usually claim that such vulnerabilities have disappeared years ago and then go on to show advanced SQL injection techniques. It seems that they exit.
References:
Date: 15 January 2007
Incident Type: Security Breach
WASC Threat Classification: SQL Injection
The site of the Belgian Defense Ministry was defaced by Turks who protested a pro-Kurdish remarks by the Belgian government.
References:
Date: 20 April 2006
Incident Type: Vulnerability Disclosure
WASC Threat Classification: SQL Injection
References:
Date: 29 March 2006
Incident Type: Vulnerability Disclosure
WASC Threat Classification: SQL Injection
www.incredibleindia.org is official Indian government tourism website.
The researcher has found that the parameter PageID in the page ms_Page.asp is vulnerable to SQL injection. He further tested that SQL error messages enable standard probing methods for finding out the number of columns and their type work.
References:
Date: 02 March 2006
Incident Type: Security Breach
WASC Threat Classification: SQL Injection
A mass defacement of a Philippine hosting service was carried our using SQL injection. It accidentally also defaced the site of the National Union of Journalists of the Philippines, which led some to believe that it was a targeted political attack.
References:
Date: 13 January 2006
Incident Type: Security Breach
WASC Threat Classification: SQL Injection
Russian hackers broke into a Rhode Island government Web site and allegedly stole credit card data from individuals who have done business online with state agencies. The hackers claimed to have stolen 53,000 credit card numbers, while the hosting service provider claims the number was just 4113.
The technical reference site is in Russian, you can use Applied Languages Solutions for an online translations.
References:
Date: 01 January 2006
Incident Type: Vulnerability Disclosure
WASC Threat Classification: SQL Injection
A CIO of a bank in Singapore reports that many application layer vulnerabilities, including SQL injection, where discovered in a banking application they purchased before it was put into production.
References:
Date: 01 November 2005
Incident Type: Security Breach
WASC Threat Classification: SQL Injection
3,800 customer credit-card numbers were stolen in the attack on Guidance Software web site. This incident is made more severe since Guidance software is a provider of software for investigating security breaches and many of its clients are security and law enforcement agencies, some of them known to be affected.
As usual in such cases the actual way in which the information was stolen was not disclosed. A federal trade commission report on the incident, published only in 2007, revealed that the incident was a result on an SQL injection attack on Guidance servers. In a settlement with the FTC, Guidance agreed to implement a comprehensive information security program, including independent, third-party audits every other year for the next ten years.
References:
Date: 01 November 2005
Incident Type: Security Breach
WASC Threat Classification: SQL Injection
A high school student used SQL injection to break into the site of a Taiwanese information security magazine from the Tech Target group and steal customer's information.
References:
Date: 07 July 2005
Incident Type: Security Breach
WASC Threat Classification: SQL Injection
The hacker who penetrated Kakaku.com was arrested after breaking into Club Tourism International Inc. Hacking was done in order to earn money to pay for tuition.
References:
Date: 05 July 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Insufficient Authorization, OS Commanding, SQL Injection
A person who discovered an SQL injection vulnerability in a USC system and informed security focus about the flaw was criminally charged with breaking into the system.
References:
Date: 18 May 2005
Incident Type: Security Breach
WASC Threat Classification: SQL Injection
References:
Date: 03 May 2005
Incident Type: Security Breach
WASC Threat Classification: SQL Injection
This incredible story from our friends at Zone-H shed light on one of those defacement attacks, which usually go unexplained. This time an infamous Saudi-Arabian hacker abused SQL injection vulnerability in Internet Explorer Administration Kit web site. And guess what type of SQL injection: A login form SQL injection!
References:
Date: 01 September 2004
Incident Type: Security Breach
WASC Threat Classification: SQL Injection
This entry is a very important one. Most are already familiar with the infamous CardSystems incident where hackers stole 263,000 credit card numbers, exposed 40 million more and several million dollars fraudulent credit and debit card purchases had been made with these counterfeit cards. As a result of the breach CardSystems nearly went out of business and was eventually purchased by PayByTouch. CardSystems is considered by many the most severe publicized information security breach ever and it caused company share holders, financial institutes and card holders damage of millions of dollars.
But since the publication of the incident a year ago the way in which the breach occurred remained a mystery.
Recently new articles about the case (listed below) revealed that SQL injection was used by the attackers to install malicious script on the CardSystems web application database which where scheduled to run every four days, extract records, zip them and export them to an FTP site.
This is one of the most stunning examples where a web application security hole was used to launch a targeted attack in order to steal money.
References:
Date: 30 June 2004
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Cross-site Scripting, SQL Injection
References:
Date: 02 February 2004
Incident Type: Vulnerability Disclosure
WASC Threat Classification: SQL Injection
References:
Date: 31 December 2003
Incident Type: Security Breach
WASC Threat Classification: Cross-site Scripting, SQL Injection
References:
Date: 05 December 2003
Incident Type: Vulnerability Disclosure
WASC Threat Classification: SQL Injection
References:
Date: 18 June 2003
Incident Type: Vulnerability Disclosure
WASC Threat Classification: SQL Injection
References:
This work is licensed under the Creative Commons Attribution License. To view a copy of this license, visit http://creativecommons.org/licenses/by/2.5/ or send a letter to Creative Commons, 559 Nathan Abbott Way, Stanford, California 94305, USA.
|
