Security: PHP-Nuke "modules/Search/index.php" SQL

Posted: Mon Apr 14, 2008 11:12 pm

I found this on [ Only registered users can see links on this board! Get registered or login! ] and thought it should be posted here i did have a quick look to see if it was already but didnt see it.

this is as evaders99 wrote:

In response to: [ Only registered users can see links on this board! Get registered or login! ]

I am posting the reply and changes

$sid is indeed not properly sanitized

in modules/Search/index.php

For Nuke Patched / Nuke Patched Core

For a graphical view, click [ Only registered users can see links on this board! Get registered or login! ]
And go to Diff to previous 1.6

Code:

FIND (inline) - 6x - six-times, only the first 3 are critical

Code:

'$sid'





TO





'".intval($sid)."'

RavenNuke

RavenNuke has fixed there's with a different code change

Code:

FIND

Code:

if (!isset($author)) { $author = ''; }





AFTER, ADD





if (!isset($sid)) { $sid = 0; } else { $sid = intval($sid); }

_________________
Evaders99

Posted: Tue Apr 15, 2008 1:27 am

Well since it's already fixed... Smile

Thanks for linking

Posted: Tue Apr 15, 2008 1:39 am

yeah but thats assuming people stay upto date Smile