Yahoo! Contributors Network was affected by a serious Time based Blind SQL Injection vulnerability which allows the theft of sensitive data.

It’s not the first time that experts discovered a flaw in the Yahoo! Contributors Network, in July 2012 has been hacked by the group of hackers called D33DS Company that stolen and published 453,491 email addresses and passwords in a document  named “Owned and Exposed”.  The file containing the credentials was later disclosed via BitTorrent and various file lockers on the web. The D33Ds hackers claimed they released the information to show the security leak at Yahoo, and not to realize frauds or for other malicious purposes.

In September 2014, the Egyptian hacker Ebrahim Hegazy has discovered a similar vulnerability in the Yahoo service that allows a Remote Code Execution and privilege escalation.

SQL Injection is considered an effective attacks technique and security experts worldwide sustain that the number of SQL injection attacks continues to grow. According to new study titled “The SQL Injection Threat Study“ published in April 2014 by the The Ponemon Institutenearly 65% of organizations suffered successfully SQL injection attacks in the last twelve months, which were able to evade victims’ defenses.