Someone asked me to take over maintaining their (quite old) website. I looked at the code, and I see that every page has calls to mysql_query, with sql strings concatenated with completely unsanitized $_GET variables. It's a huge website, and would need to be rewritten from scratch to get rid of all these problems. I'm assuming that they've never experienced any attacks, or they would have mentioned it.

Should I tell them about it, and if so, what should I say?

  • Look at it this way: it's your code now that you've been asked to maintain it.... – schroeder Jun 25 '15 at 21:54
  • @schroeder Well, they ask me to do specific changes to it. They're not asking for my own suggestions to improve the site. – clum Jun 25 '15 at 22:33
  • 2
    I hear you, and I know you aren't the owner of the code, but because you have code-level access to it, it is very, very appropriate for you to tell them that the code has risks involved. – schroeder Jun 25 '15 at 23:15
  • 1
    You won't believe what else I discovered: the passwords are stored in plain text! – clum Jun 26 '15 at 5:33
  • 1
    Use grep. Write a template. Run through and replace. Ask them for something like a BER based syntax list for the items, and ask for more money, if they want that done. – munchkin Jun 26 '15 at 5:56

They have experienced attacks, they just don't know it.

You should tell them:

  1. Assume that all data in the site has been compromised.
  2. Tell them what you told us: The site needs to be re-written.
  • And do this in writing (that is verifyable later!). Friend of mine got in a world of trouble in a similar situation. He warned the application owner, but they didn't want to fix the issues, just update the site. 3 months later a script-kiddie got in and did the usual ";drop tables". My friend got accused of borking the security while updating the site. It took a good lawyer and email-logs regarding his multiple warnings to clear him. – Tonny Jul 2 '15 at 12:15

I would inform the individual responsible for the site and data immediately. Having that in email or written form for evidence would be a good idea.

Within the communication I would reference OWASP's TOP 10 that specifically highlights the dangers of SQL injection.

Unless you have evidence that the site has been / is compromised I would not say that but I would mention that it is a possibility.

Next, I would suggest options for remediation and what resources (time and money) you think it would take to fix.

If the individual responsible still chooses to not fix just make sure that decision is documented so that you are covered.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.