OrientDB and SQL Injection Fun

when
, fri 7-9 pm
where
denhac, 700 Kalamath Street, Denver, CO 80204

OrientDB is GraphQL under the hood, but implements its own dialect of SQL to make developers feel more comfortable. Unfortunately, despite being listed as fully supported, their Python library never quite implemented parameterized queries. This means that injection exploits are there for the taking if we can just figure out how to make them work using the non-standard SQL. This meeting will be spent getting back to basics on SQLi strategies. A test system will be available and at least one solution will be shared.