Other nomination
A Race to the Bottom - Database Transactions Undermining Your AppSec
Reading a row, checking it, then writing it inside a database transaction is still racy: default isolation levels take no lock on the read, so concurrent requests all pass the check. Firing parallel requests, ideally with last-byte sync or a single-packet attack, lets an attacker overdraw a balance or push business logic past its intended limits.
Record
- Researcher
- Viktor Chuchurski
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of Viktor Chuchurski, first published at the original source. Preserved copies are kept so the citation survives its host.