full-disclosure - Question: is this exploitable?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1066484464.2754.8.camel@lappy.fuzzypenguin.net>
From: jason at dixongroup.net (Jason Dixon)
Subject: Question: is this exploitable?

On Sat, 2003-10-18 at 09:18, Jonathan A. Zdziarski wrote:
> > $sth = $dbh->prepare("insert into projects
> > values(null,\"$project\")");
> 
> $project = qq!"); delete from any_table where value in("!;
> 
> executes:
> 
> insert into projects values(null, ""); delete from any_table where value
> in("");

IIRC, using placeholders in your prepared statement should escape
everything properly.  Something like:

my $insert_stmt = "insert into projects values (?,?)";
my $sth = $dbh->prepare($insert_stmt);
$sth->execute(NULL, $project);

Of course, it's still a good idea to filter $project through a known
good regex.

I highly suggest the following title by Kevin Meltzer and Brent
Michalski.  The volume introduces the reader to CGI programming,
starting them off with good security practices, rather than trying to
tack it on as an after-thought.

Writing CGI Applications with Perl
Publisher: Addison-Wesley
ISBN: 0201710145

-J.