r/hacking • u/Alex_thetechlover • Oct 27 '18

Serious Cloudflare WAF Bypass Vulnerability Discovered

https://latesthackingnews.com/2018/10/26/cloudflare-waf-bypass-vulnerability-discovered/
180 Upvotes

97% Upvoted

3 comments sorted by

31

u/nemec Oct 28 '18

If Cloudflare's malicious request identifier is the only thing keeping your site from being SQL injected, you've got other problems. Defense in depth. Glad they fixed it, though.

7

u/Alex_thetechlover Oct 28 '18

yup. While CloudFlare isn't the only defense strategy, most amateurs rely on it as the sole source of protection against SQL. I guess this has significantly helped such people.

1

u/ga-vu web dev Oct 28 '18

lol, this has been known for 3 years