New answers tagged

2

I don't think that you can do anything with just this code. But that does not mean that this is secure in any way. You give up the control flow of your application to the user, which is not a good idea. For example, if you were to call close on the newly created object, an attacker would gain SSRF: $obj = new $_GET['x']($_GET['y']); $obj->close(); // ...


0

Bluetooth LE isn't a protocol per se. iBeacon, altBeacon, and Eddystone are examples of Bluetooth LE protocols which do not inherently have a security mechanism. For example, an attacker knowing that a particular beacon has a given set of IDs (which are broadcast indiscriminately over the air on a known frequency) can use these same IDs to "spoof" the ...


0

Are PreparedStatements sufficient? PreparedStatements are not sufficient on their own. You should step through your code and ask yourself what is necessary, and what is possible. Step through on both the client and the server side, and see what data gets sent, if it's possible to modify it, and what it does. See what things you can do. I can't see the ...


0

Your code handles the SQL insertion correctly. I have two guesses about the attack: The attacker could have repeated the request several times, and your code doesn't check if it has already downvoted the post. The attacker have sent a lot of downvote requests in a very short period of time, allowing him/her to exploit a time of check / time of use race ...



Top 50 recent answers are included