Two immediately jump to mind. One that had a massively bad impact to the company, another that might have..
First, using perl a (later-fired) co-worker added a hardcoded check like the following:
if ($client_id = "specific_id") { #email reports }
Needless to say, we emailed reports for all of our clients to a specific client, didn't go over too well considering that many of them were competitors.. It was particularly bad because he had previously been talked to about flipping the constants to avoid the = vs == bug.
Second, possibly abused but not known for sure, was found a few years after initially being put out. Our webapp created a session ID for each user, MD5 hash.
Except it started like:
StringBuffer md5HashedBuffer = new StringBuffer(userId);
Which, because the userId was an int, simply creates a string buffer of size userId, not a string buffer initially populated with userId.
The rest of the hash was added afterwards, then the one-time created, with the result that everybody's session id was the same. Changing your user id in the GET or POST would allow you to be logged in as a different user.
First, using perl a (later-fired) co-worker added a hardcoded check like the following:
if ($client_id = "specific_id") { #email reports }
Needless to say, we emailed reports for all of our clients to a specific client, didn't go over too well considering that many of them were competitors.. It was particularly bad because he had previously been talked to about flipping the constants to avoid the = vs == bug.
Second, possibly abused but not known for sure, was found a few years after initially being put out. Our webapp created a session ID for each user, MD5 hash.
Except it started like: StringBuffer md5HashedBuffer = new StringBuffer(userId);
Which, because the userId was an int, simply creates a string buffer of size userId, not a string buffer initially populated with userId.
The rest of the hash was added afterwards, then the one-time created, with the result that everybody's session id was the same. Changing your user id in the GET or POST would allow you to be logged in as a different user.