lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 17 Sep 2005 00:18:58 +0200 (CEST) From: hans <hans@...ki.xs4all.nl> To: jim999@....net Cc: Paul Laudanski <zx@...tlecops.com>, "" <r.verton@...il.com>, "" <bugtraq@...urityfocus.com>, "" <bugs@...uritytracker.com>, "" <moderators@...db.org>, "" <news@...uriteam.com>, "" <vuln@...unia.com> Subject: Re: PHP Nuke <= 7.8 Multiple SQL Injections On Fri, 16 Sep 2005, Matthias Jim Knopf wrote: > What do you gain from that? In what way would you think your advice did > ANYTHING GOOD? Could you please stop topposting? I had to read the complete thread to know what php*uke bug it was related to. > You did neither issue a "addslashes()" as appropriate for SQL-commands, > nor did you explain, why a variable set by a POST or a COOKIE could be > worse than anything you could give any URL by appending '?name=...' or > '&name=...' (->GET vars) Adding slashes, using register_globals, it's all bad. > > > These issues are due to a failure in the application to properly sanitize 'Sanitizing' input has always been a problem. Mandrake once supported phpnuke and therefor I commited a 11K line diff to them a few years back. That was to 'sanitize' only part of the problem, mostly some descent behaviour against the used dblayer. Let's stop whining about phppuke, and start using some user input validation. Hans -- <iemand> iemand heeft een gat gevonden in pdp's access.db? bel cnn http://blacklist.kernelnewbies.nl
Powered by blists - more mailing lists