bugtraq - Re: PHP Nuke <= 7.8 Multiple SQL Injections

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.50L.0509170011140.11961-100000@server.lonki.xs4all.nl>
Date: Sat, 17 Sep 2005 00:18:58 +0200 (CEST)
From: hans <hans@...ki.xs4all.nl>
To: jim999@....net
Cc: Paul Laudanski <zx@...tlecops.com>, "" <r.verton@...il.com>,
	"" <bugtraq@...urityfocus.com>, "" <bugs@...uritytracker.com>,
	"" <moderators@...db.org>, "" <news@...uriteam.com>,
	"" <vuln@...unia.com>
Subject: Re: PHP Nuke <= 7.8 Multiple SQL Injections

On Fri, 16 Sep 2005, Matthias Jim Knopf wrote:

> What do you gain from that? In what way would you think your advice did
> ANYTHING GOOD?

Could you please stop topposting? I had to read the complete thread to
know what php*uke bug it was related to.

> You did neither issue a "addslashes()" as appropriate for SQL-commands,
> nor did you explain, why a variable set by a POST or a COOKIE could be
> worse than anything you could give any URL by appending '?name=...' or
> '&name=...' (->GET vars)

Adding slashes, using register_globals, it's all bad.

> > > These issues are due to a failure in the application to properly sanitize

'Sanitizing' input has always been a problem. Mandrake once supported
phpnuke and therefor I commited a 11K line diff to them a few years
back. That was to 'sanitize' only part of the problem, mostly some
descent behaviour against the used dblayer.

Let's stop whining about phppuke, and start using some user input
validation.

Hans

-- 
<iemand>
    iemand heeft een gat gevonden in pdp's access.db? bel cnn

http://blacklist.kernelnewbies.nl