Assignment
Working on a study guide regarding- SQL injections.
Scenario about a lady named Susan:
Susan was a SQL programmer working at a reputable company. Susan and her husband had been happily married for almost 10 years. Susan wanted to give a surprise gift to her husband on their 10th wedding anniversary. E-shopping4u.com was a well-known online shopping portal that was offering quality products with good discounts on gift items. It was also offering gift vouchers to customers who purchased their products. Susan decided to purchase the gift from E-shopping4u.com. She ordered a costly gift for her husband much in advance, as she wanted the gift to be delivered on the anniversary day. She eagerly waited for the gift.]
But things did not work the way she wanted; the gift she had ordered was not delivered on the anniversary day. She wanted to know why the company failed to deliver. She searched the Web site for contact numbers. She tried to contact the management of the shopping portal but could not get any response. After many failed attempts, in frustration, she decided to take revenge on the shopping portal.
Susan searched the Internet to find security vulnerabilities related to shopping portals. She searched various security-related Web sites and vulnerability databases on the Internet. Finally, she found an online forum where some user had posted the SQL vulnerabilities of E-shopping4u.com. Half of Susan's work was done. Being a SQL programmer herself, she knew how the SQL vulnerabilities of a shopping portal could be exploited. She crafted a SQL statement and inserted that statement in place of a username in the portal's user registration form. She was able to access the entire database of E-shopping4u. It was the best chance for her to take revenge on the shopping portal.
Here are some questions I have about this:
A. What could Susan have done before ordering her item?
B. What could the consequences be for Susan's using SQL injection to access E-shopping4u.com's database?
C. What are some of the legal and ethical ramifications of Susan modifying the database?