SQL Injection Legalities

From: Deus, Attonbitus (Thor@HammerofGod.com)
Date: 07/17/02 

Date: Wed, 17 Jul 2002 09:48:01 -0700
To: Pen-Test <PEN-TEST@SECURITYFOCUS.COM>
From: "Deus, Attonbitus" <Thor@HammerofGod.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I hesitate asking the group about law, but here goes:

Lets say a site gives you the capability to search their product-base via a
web input box. You know, the standard search/submit deal.

You type in "bicycle" and it gives you everything that starts with
"bicycle." Simple enough. As we all know, web app susceptibility to SQL
injects runs amok; lets say in this case that instead of typing "bicycle,"
I type "bicycle' or 1=1--" and get all the products. Have I broken the
law? More specifically, have I broken the law in the US?

One could argue that the site is allowing me to specify what I want to see,
and all I am doing is typing in what I want... Though the developer may
not have intended for me to pull up the data like that, does my doing so
constitute a crime?

I'm not looking for ethical or moral debate here, I am hoping someone has
some distinct legal experience who knows. Thanks.

AD

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.1

iQA/AwUBPTWfwYhsmyD15h5gEQLKuACgioeYyenUFEbI6HXpYbo5AjL920cAoNJv
ANJ4aOg8vjqGS5JSZK2V5Hyt
=nm/7
-----END PGP SIGNATURE-----

----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/

Relevant Pages

  • Re: Critical
    ... risk of being hurt and risk of being cited, ... but we can argue that the law is dumb. ... A quick perusal of the site show most of the emphasis is on "bicycle ... "This bill initially requested a three-foot minimum passing distance ...
    (rec.bicycles.tech)
  • Re: UK considers law blaming driver in all car/bike crashes!!
    ... I would guess a bicycle would have to ... law or what level of government would have jurisdiction. ... government has given you as an auto drivers might be curtailed. ...
    (rec.autos.driving)
  • Re: UK considers law blaming driver in all car/bike crashes!!
    ... the larger vehicle would be at fault with the smallest possible vehicle ... "Government advisers are pushing for changes in the civil law that will ... The bicycle has less power. ...
    (rec.autos.driving)
  • Re: UK considers law blaming driver in all car/bike crashes!!
    ... "Government advisers are pushing for changes in the civil law that will ... The bicycle has less power. ... change in law that defaults motorists as being at fault in collisions. ...
    (rec.autos.driving)
  • Re: UK considers law blaming driver in all car/bike crashes!!
    ... The article was about changing civil law regarding liability. ... Try it on a bicycle. ... As I said if you don't have the skill to function where pedestrians have the ... bicycles and pedestrians out on the interstate highway system? ...
    (rec.autos.driving)
Quantcast