56

Well someone messed up.

Comments
  • 0
    so i guess it's written in C?
  • 1
    @tisaconundrum I don't think so. In C, strings are created with double quotes, single quotes are for characters. Here we have: "concat" command and single quotes for strings, so it smells like some kind of SQL.
  • 4
    What's interesting is it looks right on the receipt. The issue seems to be they entered the data in a format the receipt code could handle but not the self scanner.

    I'm betting "father's day card" was entered in the system WAY before these self scanners ever existed and this wasn't tested.
  • 0
    I really wonder with that logic how hard it would be to encode a SQL command into a bar code and see if you could do SQL Injection. Nice little hobby project for those of you who live near target.
  • 1
    @MyZeus while I like your thought process, that wouldn't be possible to do as the Barcode is only a number to be read.
  • 0
    @tisaconundrum What about QR Codes? Those can even store links. Can we not encode text and symbols into certain types of bar codes?
Add Comment