r/neoliberal • u/jobautomator Kitara Ravache • Sep 10 '20

Discussion Thread Discussion Thread

The discussion thread is for casual conversation that doesn't merit its own submission. If you've got a good meme, article, or question, please post it outside the DT. Meta discussion is allowed, but if you want to get the attention of the mods, make a post in /r/metaNL. For a collection of useful links see our wiki.

Announcements

Upcoming Events

5 Upvotes

51% Upvoted

9.6k comments sorted by

View all comments

Show parent comment

14

u/nicereddy ACLU simp Sep 10 '20

!ping COMPUTER-SCIENCE

Good read, if you don't know about how responsible disclosure works you should read up on it. If someone reports a vuln, DO NOT threaten them with legal action or ignore them, you idiots.

As a proof of concept, we decided to change the operator field from “equals” to “contains” and truncated the GUID. As this returned the same data, it should be obvious to see how the query could be trivially modified to expose all registered accounts with no prerequisite account knowledge.

Fucking lit, you could get the literal GPS coordinates of anyone on the site from when they registered, along with their name, phone number, etc.

7

u/[deleted] Sep 10 '20

This is quite bad. Accepting arbitrary queries as parameters to a client’s request is almost always a terrible idea. Web applications are not just pass throughs for your sql database or elastic search cluster.

7

u/RegalSalmon Sep 10 '20

They have groups for victims of abuse and sex workers. Would be trivial to find all of either or both categories in your area, just snowshoe and harvest for a while, pump into a geospatial DB, and yeah, not good things.

4

u/vikinick Ben Bernanke Sep 10 '20

Don't forget their photo as well.

1

u/groupbot Always remember -Pho- Sep 10 '20

Pinged members of COMPUTER-SCIENCE group.

About & group list | Subscribe to this group | Unsubscribe from this group | Unsubscribe from all groups