bugtraq - Re: SQL Injection in CACTI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 17 Aug 2004 09:53:14 +0100
From: Thomas Chiverton <thomas.chiverton@...efinger.com>
To: nando@...red.net
Cc: bugtraq@...urityfocus.com
Subject: Re: SQL Injection in CACTI

On Monday 16 Aug 2004 21:11 pm, Fernando Quintero wrote:
>                 php_flag magic_quotes_gpc Off

Cacti 0.8.5a does not ship with this set Off*, so this must be a Debian 
packaging error.
The install instructions at 
http://www.raxnet.net/products/cacti/documentation.php?action=view&id=6
make no mention off having to disable the magic quote feature.

I am running this version of Cacti with magic quotes On fine, this is the PHP 
default, afaik.

*Cacti does not have a .htacess in its www root and the install instructions 
(above) do not mention any special PHP settings that need applying.

-- 
Tom Chiverton 
Advanced ColdFusion Programmer

Tel: +44(0)1749 834997
email: tom.chiverton@...efinger.com
BlueFinger Limited
Underwood Business Park
Wookey Hole Road, WELLS. BA5 1AF
Tel: +44 (0)1749 834900
Fax: +44 (0)1749 834901
web: www.bluefinger.com
Company Reg No: 4209395 Registered Office: 2 Temple Back East, Temple
Quay, BRISTOL. BS1 6EG.
*** This E-mail contains confidential information for the addressee
only. If you are not the intended recipient, please notify us
immediately. You should not use, disclose, distribute or copy this
communication if received in error. No binding contract will result from
this e-mail until such time as a written document is signed on behalf of
the company. BlueFinger Limited cannot accept responsibility for the
completeness or accuracy of this message as it has been transmitted over
public networks.***