2Sep 22 6:48 PM · 1d ago · 5 comments · 1 source · development 2 of 4
A commenter identified a critical security design flaw in FoxPro's Database Container (DBC) format: stored procedures are stored as plain text in memo fields and run with full Win32 API access, allowing trivial modification of triggers and code execution. The FoxDev creator acknowledged the issue and committed to adding runtime verification.
“There's a huge security hole in the Database Container (DBC) design…With a little technical knowledge, one can modify that INSERT trigger to whatever you like.”
mikestew
boredjohnnyFoxDev Studio creatormikestewSecurity researcher, former FoxPro developerMicrosoftFoxPro publisher (discontinued 2007)
The whole story articlespostscommentsthe bright band is this development · numbered dots are the others · click one to jump
I worked with a physician's office in 2006, and the lead physician had cobbled together a system for patient tracking using Visual FoxPro. It was a monstrosity, and using it over a network drive gave all sorts of file locks and issues with multiple people changing the same record (usually the physician and front of house staff when checking the…
Here’s my problem with reviving FoxPro in any form: there’s a huge security hole in the Database Container (DBC) design. For DBCs to be useful, they must be read/write to all users (there is no permissions scheme). DBCs have stored procedures that can run any FoxPro code, including Win32 calls made from the FoxPro runtime. The stored procedures…
Hey, I got to mention this recently! One of my bizarre claims to fame was writing this little tool[0] a few employers back to convert Visual FoxPro database files to PostgreSQL as part of a migration. For a while we had to run it as a cron job so that people could to data entry in an old VFP app but others could run fast reports on our web app…
Microsoft might have killed FoxPro but even in windows 11 they still have the icon for it in moricons.dll where it will live presumably forever in every version of windows Microsoft ever releases.