Facebook still lacks security XSS and SQLi vulnerable

Facebook the largest social network, since February has over 845 million active users.  With so many active users security must be the main concerns of this company. However we discover that Facebook is not that secure after all. Two of the most common vulnerabilities where discovered.




1) XSS vulnerability – Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications that enables attackers to inject client-side script into Web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same origin policy.

The following link was found vulnerable to XSS

  • http://apps.facebook.com/flixville/search/
  • http://apps.facebook.com/flixville/search/?locale=US&searchText=%22%3E%3Cimg%20src=%22http://www.secure-my-internet.com/wp-content/uploads/2011/02/internet-security.jpg%22%3Eby%20sector%20404-infected link


2) SQL injection – An SQL injection is often used to attack the security of a website by inputting SQL statements in a web form to get a badly designed website to perform operations on the database (often to dump the database content to the attacker) other than the usual operations as intended by the designer. SQL injection is a code injection technique that exploits a security vulnerability in a website’s software.

The following link was found to be vulnerable to SQL attacks:



Leave a Reply