Collected research
MSSQL Identified as Vulnerable to Emoji String Exploitation
Microsoft SQL Server's Windows Unicode collation compares a goblin emoji as equal to an empty string, so a login lookup matching a supplied email returns accounts whose email is blank. That lets an attacker brute-force passwords against those accounts without knowing a username.
Record
- Researcher
- DecryptLOL and @decrypt_lol
- Published by
- Decrypt LOL
- Date
- Topic
- Other
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of DecryptLOL and @decrypt_lol, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .