New answers tagged appsec
To expand on Xander's answer - when you use a parameterized query the parameters are never inserted directly into the statement. Instead, the query itself along with all of the parameters are passed to a stored procedure called sp_executesql. When executed this way the parameters are treated as data rather than being parsed out as part of a SQL statement, ...
A more common term for this is "parameterized SQL". You are still taking user data, as you pointed out, but the security lies in the fact that the application knows what is data, and what is executable. When you build a SQL statement as a string and pass it in it's completed entirety to the database, the application simply has to trust that the SQL ...
I generally inform my clients about the multiple login "issue", especially when there is no last logon information available. Is it a vulnerability? Personally, I don't think it is, it could be a feature where a client sometimes requires to be logged in multiple times (due to poor application development for example). I call this finding "Simultaneous login ...
What you describe is not in and of itself a vulnerability. However, if logging in does not completely over-write client-side session information (eg. cookies or other persistent storage), or if elements of the session are tied to the client's IP address, there is the potential for a privilege-escalation or session hijacking attack.
Top 50 recent answers are included