[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [FD] DoS - Intuit QuickBase
From:       Scott Arciszewski <scott () arciszewski ! me>
Date:       2014-04-29 16:18:33
Message-ID: CAPKwhwueEkWwpL3fRaV0=f57eJTvpxErqW3YdBJi43eK6+PKPA () mail ! gmail ! com
[Download RAW message or body]

Vendor: http://quickbase.intuit.com

Intuit QuickBase sells itself as a combination database and business
intelligence tool. Its performance is terrible; however, that doesn't stop
some businesses from using it as the back-end for their apps.

A fun fact that they don't advertise is that they limit every database to
60MB* and charge tens of thousands of dollars for every extra 10 MB.

Thus, any app that relies on QuickBase is vulnerable to an incredibly
Denial of Service attack vector!

Steps to exploit:
1. Find a service that uses QuickBase in lieu of a relational database.
2. Find a feature in the aforementioned service that inserts data into the
database.
3. Write a script that will trigger this data insert a few hundred times
per minue.
4. Wait an hour or two.
5. ???
6. LOSS!

Seriously, if anyone is ever thinking about using QuickBase as a central
database for their business, you're better off with SQL Server (eww).

* Footnote: When I was first learning to program PHP back in 2002, the
MySQL databases provided by my free webhosting provider were limited to 100
MB each.

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
[prev in list] [next in list] [prev in thread] [next in thread]