Collected research
A Scientific Notation Bug in MySQL exposed AWS WAF
24/7 managed detection, response, and expert cybersecurity services
MySQL and MariaDB silently discard a malformed scientific-notation token such as 1.e when no digit follows the e, so the query stays valid while looking like nonsense to anything else parsing it. Injecting that token made SQL injection payloads unrecognisable to AWS WAF and to ModSecurity with libinjection, restoring injection against protected sites.
Record
- Document
- 24/7 managed detection, response, and expert cybersecurity services
- Researcher
- Marc Olivier Bergeron and @GoSecure_Inc
- Published by
- GoSecure
- Date
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Marc Olivier Bergeron and @GoSecure_Inc, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .