Nightmare On Database Street: 5 Database Security Horror Stories

darkreading.com

14 pointsvectorbunny3 comments

"...they converted SQL commands into bar codes, printed them out and scanned them.

When placed under the scanner we were able to perform SQL injection against the price check Web application..."

SQL injection via printed barcodes. Epic.

I laughed when I read this too! That's true "outside the box" thinking.

Funnily enough, someone suggested something similar at work a few days ago and I had to shoot him off the air. He wanted to use URLs encoded in a QR to trigger an action (say, "use coupon"). No authentication, nothing. The idea has some merit, as we wanted this feature to work on any kind of phone and we only have Android and iOS clients, but the whole idea of having a GET request trigger a change on the server made my skin crawl.

Reply on news.ycombinator.com