Date: 05 July 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Insufficient Authorization, OS Commanding, SQL Injection

A person who discovered an SQL injection vulnerability in a USC system and informed security focus about the flaw was criminally charged with breaking into the system.

References:

• Man charged with accessing USC student data [Security Focus]
• Flawed USC admissions site allowed access to applicant data [Security Focus]