PHP-Nuke Site is open to SQL Injection Attack HELP!

dark-dude · Worker Joined: Jun 29, 2003 Posts: 146 Location: Oklahoma

I ran the analyzer from nukecops and got this error:

Code:

php.ini magic_quotes.gpc value Reason For Vulnerability
Not Enabled (Not "On") If your magic_quotes_gpc is not On, as it currently isn't, you should change this immediately to the On value. If left disabled then your site is susceptible to member password retrieval and member admin escalation. For full details and exploits for testing go here. For details on exactly what code to insert if you cannot enable magic_quotes_gpc read here.

Where do I fix this at? I have read and read and ppl keep talkin about php.ini but I don't have one on FreeBSD so they must be using windows. Also I see htis even tho I have loaded GD several times:

Code:

GD Library Information Extension Status
Not-Loaded

Any ideas on this also Raven?

Raven · Posted: Sat Dec 06, 2003 12:02 pm

If you are running php and you host your own server, you have a php.ini. To see where it is located, run this script

Code:

<?
phpinfo();
?>

Towards the top you will see the location of php.ini.

dark-dude · Worker Joined: Jun 29, 2003 Posts: 146 Location: Oklahoma

ok found that now....why can't i see my security codes? it says this in analyzer
GD Library Information Extension Status
Not-Loaded
and i installed gd and php4 so..what else is there? Evil or Very Mad