Posted by Doug Huff on Jun 20
I have two independent sources claiming known SQLi vulnerabilities in MtGox.
One of said SQLi vulnerabilties was confirmed to be patched on the 16th.
The other was not patched, to anyone's knowledge, at the time of the market crash and database leak. The one that was
not patched could have plausibly been used to dump the user table.
The details follow in these chat logs. POC for the referenced xss+csrf is also provided. Whether or not it…
Source: More plausible mtgox.com post-mortem (Bitcoin fun week!)
