Re: Possible phpBB <=2.0.11 bug or sql injection?

["kaosone+[ONE]+" <kaosone () gmail com>]

On 17 Feb 2005 09:54:57 -0000, jtm297 () optonline net
<jtm297 () optonline net> wrote:
> It seems it has something to do with the the \'s *'s and length. I am not sure if this is a big bug but I decided to 
> try that after looking at search.php

look at 

function phpbb_clean_username($username)
{
        $username = htmlspecialchars(rtrim(trim($username), "\\"));
        $username = substr(str_replace("\\'", "'", $username), 0, 25);
        $username = str_replace("'", "\\'", $username);

        return $username;
}

the problem is in the substr;
take for exemple phpbb_clean_username("aaaaaaaaaaaaaaaaaaaaaaaa\a")

$username = htmlspecialchars(rtrim(trim($username), "\\"));
// username not changed aaaaaaaaaaaaaaaaaaaaaaaa\a
$username = substr(str_replace("\\'", "'", $username), 0, 25);
// username become  aaaaaaaaaaaaaaaaaaaaaaaa\

and the query become

SELECT user_id FROM phpbb_users WHERE username LIKE 'aaaaaaaaaaaaaaaaaaaaaaaa\' 
(notice the last ' escaped)

a quick fix is to add $username = rtrim($username, "\\") before the
function returns