WHID 2005-21: Insufficient authentication on USC admissions site allowed access to applicants data
A person who discovered an SQL injection vulnerability in a USC system and informed security focus about the flaw was criminally charged with breaking into the system.
Additional information:
- Man charged with accessing USC student data [Security Focus, Apr 20 2006]
- Flawed USC admissions site allowed access to applicant data [Security Focus, Jul 5 2005]
Attack Method:
Incident Outcome:
