SQL injection vulnerability in the login GUI

jeftsd / SmartHome

0 stars 0 forks source link

SQL injection vulnerability in the login GUI #2

Open eonsik opened 4 years ago

eonsik commented 4 years ago

The login GUI has a SQL injection vulnerability. This SELECT statement returns the first username in the user table, regardless of the username and password input.

3 1

@jeftsd @eonsik

eonsik commented 4 years ago

Solution: force HTTPS, firewalls, and disable dynamic SQL