Yahoo site flaw uncovered

SQL injection attacks are a common way for hackers to compromise web sites

Data security firm Imperva today disclosed a new vulnerability in a Yahoo site that could lead to a large-scale data breach.

The SQL injection flaw - known as a Blind SQLi problem – was found on the Yahoo jobs site by researchers after they listened in on conversations between hackers on an illegal forum site, according to Imperva CTO Amichai Shulman.

Although it doesn't appear that the hackers got past the planning stage, the incident is a timely reminder of the need for web companies to vet code thoroughly, and to be alert and ready to respond quickly when vulnerabilities are disclosed, as Yahoo appears to have done.

"I think all the large web companies are quite experienced now in protecting their sites and Yahoo were very quick to respond in this case," said Shulman.

"I reported the incident, caught a flight to the US and by the time I landed I had a reply from them saying they had identified and fixed it."

The particular SQL injection flaw found here allows hackers to export data at a slower rate than regular SQL attacks, but it could still have lead to the personal information of large numbers of people being compromised, he added.