Bugtraq mailing list archives
Re: Re: [KAPDA::#16] - SMF SQL Injection
From: polnby () yahoo com
Date: 11 Dec 2005 12:29:17 -0000
Take a better look at your \'Memberlist.php\' source code. // Select the members from the database. $request = db_query(\" SELECT mem.ID_MEMBER FROM {$db_prefix}members AS mem LEFT JOIN {$db_prefix}log_online AS lo ON (lo.ID_MEMBER = mem.ID_MEMBER) LEFT JOIN {$db_prefix}membergroups AS mg ON (mg.ID_GROUP = IF(mem.ID_GROUP = 0, mem.ID_POST_GROUP, mem.ID_GROUP)) WHERE mem.is_activated = 1 ORDER BY \" . $sort_methods[$_REQUEST[\'sort\']][$context[\'sort_direction\']] . \" LIMIT $_REQUEST[start], $modSettings[defaultMaxMembers]\", __FILE__, __LINE__); printMemberListRows($request); mysql_free_result($request); ---------------------- // Find the members from the database. // !!!SLOW This query is slow. $request = db_query(\" SELECT mem.ID_MEMBER FROM {$db_prefix}members AS mem LEFT JOIN {$db_prefix}log_online AS lo ON (lo.ID_MEMBER = mem.ID_MEMBER) LEFT JOIN {$db_prefix}membergroups AS mg ON (mg.ID_GROUP = IF(mem.ID_GROUP = 0, mem.ID_POST_GROUP, mem.ID_GROUP)) WHERE \" . implode(\" $query OR \", $fields) . \" $query$condition AND is_activated = 1 LIMIT $_REQUEST[start], $modSettings[defaultMaxMembers]\", __FILE__, __LINE__); printMemberListRows($request); mysql_free_result($request); ---------------------- Isn`t posible for an attacker to modify the query logic?
Current thread:
- [KAPDA::#16] - SMF SQL Injection alireza hassani (Dec 09)
- <Possible follow-ups>
- Re: [KAPDA::#16] - SMF SQL Injection grudge (Dec 10)
- Re: [KAPDA::#16] - SMF SQL Injection ascii (Dec 12)
- Re: Re: [KAPDA::#16] - SMF SQL Injection retrogod (Dec 12)
- Re: Re: [KAPDA::#16] - SMF SQL Injection polnby (Dec 12)
- Re: Re: [KAPDA::#16] - SMF SQL Injection Steven M. Christey (Dec 12)
- Re: Re: Re: [KAPDA::#16] - SMF SQL Injection grudge (Dec 14)