Researchers find SQL injection to bypass airport TSA security checks
Researchers Ian Carroll and Sam Curry discovered the vulnerability in FlyCASS, a third-party web-based service that some airlines use to manage the Known Crewmember (KCM) program and the Cockpit Access Security System (CASS). KCM is a Transportation Security Administration (TSA) initiative that allows pilots and flight attendants to skip security screening, and CASS enables authorized pilots to use jumpseats in cockpits when traveling.
Definitions:
SQL injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution.
![](https://kbin.life/media/cache/resolve/entry_thumb/33/6c/336c1ee967c78d0a1fc71d084ad3a08f63b418d6fbeb6267f4d8183618dc56ff.jpg)