bugtraq - RE: Possible phpBB <=2.0.11 bug or sql injection?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <003701c51559$84999ee0$020aa8c0@mcleod>
Date: Fri, 18 Feb 2005 02:31:06 +0100
From: Miguel Angel Rodríguez Jódar <rodriguj@....us.es>
To: <bugtraq@...urityfocus.com>
Subject: RE: Possible phpBB  <=2.0.11 bug or sql injection?

> It seems it has something to do with the the \'s *'s and length. I am not
sure if this is a big bug but I decided to 
> try that after looking at search.php

Not sure either but I think it's quite serious as the name of the database,
among other things, is displayed.
Maybe it's good idea to alter that line so "irrelevant" information remains
hidden (at least until a better solution arrives):

if ( !($result = $db->sql_query($sql)) )
{
  message_die(GENERAL_ERROR, "Couldn't obtain list of matching users
(searching for: $search_author)");
}

--
Miguel Angel Rodriguez Jodar | http://www.atc.us.es
Departamento de Arquitectura y Tecnologia de Computadores
Universidad de Sevilla
Spain