Vendor: http://quickbase.intuit.com
Intuit QuickBase sells itself as a combination database and business intelligence tool. Its performance is terrible; however, that doesn't stop some businesses from using it as the back-end for their apps. A fun fact that they don't advertise is that they limit every database to 60MB* and charge tens of thousands of dollars for every extra 10 MB. Thus, any app that relies on QuickBase is vulnerable to an incredibly Denial of Service attack vector! Steps to exploit: 1. Find a service that uses QuickBase in lieu of a relational database. 2. Find a feature in the aforementioned service that inserts data into the database. 3. Write a script that will trigger this data insert a few hundred times per minue. 4. Wait an hour or two. 5. ??? 6. LOSS! Seriously, if anyone is ever thinking about using QuickBase as a central database for their business, you're better off with SQL Server (eww). * Footnote: When I was first learning to program PHP back in 2002, the MySQL databases provided by my free webhosting provider were limited to 100 MB each. _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
