lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 17 Sep 2005 00:18:58 +0200 (CEST)
From: hans <hans@...ki.xs4all.nl>
To: jim999@....net
Cc: Paul Laudanski <zx@...tlecops.com>, "" <r.verton@...il.com>,
	"" <bugtraq@...urityfocus.com>, "" <bugs@...uritytracker.com>,
	"" <moderators@...db.org>, "" <news@...uriteam.com>,
	"" <vuln@...unia.com>
Subject: Re: PHP Nuke <= 7.8 Multiple SQL Injections


On Fri, 16 Sep 2005, Matthias Jim Knopf wrote:


> What do you gain from that? In what way would you think your advice did
> ANYTHING GOOD?

Could you please stop topposting? I had to read the complete thread to
know what php*uke bug it was related to.

> You did neither issue a "addslashes()" as appropriate for SQL-commands,
> nor did you explain, why a variable set by a POST or a COOKIE could be
> worse than anything you could give any URL by appending '?name=...' or
> '&name=...' (->GET vars)

Adding slashes, using register_globals, it's all bad.

> > > These issues are due to a failure in the application to properly sanitize

'Sanitizing' input has always been a problem. Mandrake once supported
phpnuke and therefor I commited a 11K line diff to them a few years
back. That was to 'sanitize' only part of the problem, mostly some
descent behaviour against the used dblayer.

Let's stop whining about phppuke, and start using some user input
validation.

Hans

-- 
<iemand>
    iemand heeft een gat gevonden in pdp's access.db? bel cnn

http://blacklist.kernelnewbies.nl


Powered by blists - more mailing lists