“Anyone with basic knowledge of SQL injection could login to this site and add anyone they wanted to KCM and CASS, allowing themselves to both skip security screening and then access the cockpits of commercial airliners.”
FlyCASS, apparently run by one person, fell to a single quote in the username field. That made Carroll and Sam Curry admins of Air Transport International, free to enroll anyone in Known Crewmember and cockpit jumpseat access. DHS took the report on April 23 and then stopped answering. The TSA press office denied the hole and quietly deleted the web page that proved them wrong.