Other nomination
A Scientific Notation Bug in MySQL exposed AWS WAF
MySQL and MariaDB silently discard a malformed scientific-notation token such as 1.e when no digit follows the e, so the query stays valid while looking like nonsense to anything else parsing it. Injecting that token made SQL injection payloads unrecognisable to AWS WAF and to ModSecurity with libinjection, restoring injection against protected sites.
Record
- Researcher
- Marc Olivier Bergeron and @GoSecure_Inc
- Published by
- GoSecure
- Date
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Marc Olivier Bergeron and @GoSecure_Inc, first published at the original source. Preserved copies are kept so the citation survives its host.