Dreamtilt for non Australian readers is a cheap dial-up ISP for Australia. Now being a fairly well established ISP you would think that they would have decent web coders for their user login parts of their sites. Think again, several weeks back I stumbled upon a poorly written login function on their site that allowed the use of a simple SQL injection (text book styled), that allowed access to login without a valid username and password. The exploit could have been used to edit or delete (lets just hope they keep backups at-least) tables. Now the exploit has been fixed after I contacted the site via email (only took them a week to include one simple function) so I guess I can talk about this now. It got me thinking, how many dodgy programers are out in the wild. Considering that this a simple thing and any web developer should test or sources of injections before releasing a site to the public. I am by no means a programer, except for the occasional script for work.
I suggest you read http://thedailywtf.com/ if you have time. Most dodgy programs end up there.
And Dreamtilt, well done.


