Don't click it, that would be wrong...
Jan 20

Don't click it, that would be wrong...

This link runs a slooow SQL query on the RIAA’s server. Don’t click it; that would be wrong.

Found on reddit.com. I clicked it, just out of curiosity. It pulled a press-releases index page. I don’t know how someone knows it’s slow.

by Deane   January 20, 2008 5:02 PM    |   Follow Gadgetopia on Twitter

Comments

by Josh,   January 20, 2008 6:56 PM  

Looks like SQL injection if you look at the URL. The "news year filter" parameter is presumably just supposed to have a year but someone must think that it will execute the SQL at the end:

"2007%20UNION%20ALL%20SELECT%20BENCHMARK(100000000,MD5('asdf')),NULL,NULL,NULL,NULL%20--"

by Dave,   January 20, 2008 7:12 PM  

It was a very long running query before someone used the same vulnerability to delete their CMS's entire database. Read the comments on the reddit thread.

by Deane,   January 20, 2008 11:13 PM  

Oh, great. So I unwittingly tried to hack the RIAA? The link was a TinyUrl -- I should have known better. Nice.

Men in dark suits and sunglasses should be showing up anytime now...

Add Comment