Archive for May, 2009

MySQL comparison catch: ‘abc’ = 00

Monday, May 25th, 2009

I was shocked to find a weakness in my authentication library today. It was possible to get around the password check if you knew the username. All you had to do was to enter 00 as the password. Or you just entered 00 as the username too and you got authenticated as the first user.