Industry News: ESG5

The target: Freepik, a website providing high quality free photos and graphic design. 

The take: 8.3 million records of personally identifiable information including: emails, usernames, and passwords.

The attack vector: An SQL injection was used to breach Freepik’s systems and allowed attackers to dump their user information. Attacks of this nature take advantage of poor controls in text input fields to send malicious instructions to the target database.

Any field where a user can submit text in web applications should be sanitized as a secure coding best practice to ensure these kinds of malicious commands cannot be submitted.

Read more...