Home •  Forum •  FAQ •  Search •  Recent Topics •  Memberlist •  Register •  Log in 
Forum » Icy Phoenix Support » Older Versions Archive » Old Patches

058-015 - Admin Hacks List SQL Injection

This topic is locked: you cannot edit posts or make replies.

 

Mighty Gorgon
Quote
Posts: 7192 Location: Borgo San Michele
Tue 28 Nov, 2006 23:19
Subject: 058-015 - Admin Hacks List SQL Injection
Hi All,
the admin hacks list could have a potential issue:

http://milw0rm.com/exploits/2851

I didn't try the exploit, but after looking at the code, I would fix it in this way:

OPEN adm/admin_hacks_list.php

FIND
Code: [Download] [Hide] [Select]
if (count($_POST))


BEFORE ADD
Code: [Download] [Hide] [Select]
$hack_id = intval($hack_id);


You should apply this patch as soon as possible.

Profile PM   Website
Zuker
Quote
Posts: 2134 Location: BA
Tue 28 Nov, 2006 23:59
Subject: Re: 058-015 - Admin Hacks List SQL Injection
Thanks MG, patched on my site

Profile PM   Website MSN Skype
moreteavicar
Quote
Posts: 608 Location: Classified
Wed 29 Nov, 2006 15:50
Subject: Re: 058-015 - Admin Hacks List SQL Injection
Thanks MG :up:

Profile PM  
Skorpion
Quote
Posts: 11 Location: Lanciano
Wed 29 Nov, 2006 16:39
Subject: Re: 058-015 - Admin Hacks List SQL Injection
done ;)

Profile PM   Website MSN Skype
fab120
Quote
Posts: 41
Wed 29 Nov, 2006 19:19
Subject: Re: 058-015 - Admin Hacks List SQL Injection
I Have tested the bug but it don't work on XS.

however thanks you for the patch!

Profile PM   Website
TheSteffen
Quote
Posts: 1625 Location: Magdeburg
Fri 01 Dec, 2006 14:03
Subject: Re: 058-015 - Admin Hacks List SQL Injection
Thanks a lot :)

Profile PM  
This topic is locked: you cannot edit posts or make replies.
 

Page 1 of 1


  
You cannot post new topics
You cannot reply to topics
You cannot edit your posts
You cannot delete your posts
You cannot vote in polls
You cannot attach files
You can download files
You cannot post calendar events

   

This is a "Lo-Fi" version of our main content. To view the full version with more information, formatting and images, please click here.

Powered by Icy Phoenix based on phpBB
Generation Time: 0.4473s (PHP: 13% SQL: 87%)
SQL queries: 29 - Debug Off - GZIP Enabled