---
id: 4557
title: "Why 2FA would not have saved HT?"
source_domain: blog.quarkslab.com
source_url: "https://blog.quarkslab.com/why-2fa-would-not-have-saved-ht.html"
published_at: "2015-07-07T22:00:00Z"
tags: ["sql-injection", "authentication", "python", "vulnerability", "2fa", "yubikey"]
phying_url: "https://phying.com/item/4557"
lang: en
---

# Why 2FA would not have saved HT?

## Summary

A trivial SQL injection in yubico-yubiserve, a Python YubiKey OTP server: an unfiltered publicID parameter in the OATH path lets attackers run SQL; the flaw is in the server, not the hardware.

## Intelligence Metadata

- **Sources:** blog.quarkslab.com
- **Published:** 2015-07-07T22:00:00Z
- **Original:** https://blog.quarkslab.com/why-2fa-would-not-have-saved-ht.html
- **Phying News:** https://phying.com/item/4557