Bugtraq mailing list archives
Re: [waraxe-2007-SA#053] - Critical Sql Injection in NukeSentinel 2.5.11
From: gmdarkfig () gmail com
Date: 28 Sep 2007 07:20:59 -0000
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5125 Same as mine: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1171 [me] # +nsbypass.php # 16. $tid = intval($tid); # 17. if(isset($_COOKIE['admin']) && !empty($_COOKIE['admin'])) { # 18. $abadmin = base64_decode($_COOKIE['admin']); # 19. $abadmin = explode(":", $abadmin); # 20. $a_aid = "$abadmin[0]"; # 21. $a_pas = "$abadmin[1]"; # 22. } #.... # +nsbypass.php # 24. $num = $db->sql_numrows($db->sql_query("SELECT * FROM ".$prefix."_authors WHERE `aid`='$a_aid' AND `pwd`='$a_pas'")); # 25. $tum = $db->sql_numrows($db->sql_query("SELECT * FROM ".$prefix."_nsnst_tracked_ips WHERE `tid`='$tid'")); # [you] ----------->[source code]<------------ if(isset($_COOKIE['admin']) && !empty($_COOKIE['admin'])) { $abadmin = base64_decode($_COOKIE['admin']); $abadmin = explode(":", $abadmin); $a_aid = "$abadmin[0]"; $a_pas = "$abadmin[1]"; } $num = $db->sql_numrows($db->sql_query("SELECT * FROM ".$prefix."_authors WHERE `aid`='$a_aid' AND `pwd`='$a_pas'")); ------------>[/source code]<-----------
Current thread:
- [waraxe-2007-SA#053] - Critical Sql Injection in NukeSentinel 2.5.11 come2waraxe (Sep 25)
- <Possible follow-ups>
- Re: [waraxe-2007-SA#053] - Critical Sql Injection in NukeSentinel 2.5.11 gmdarkfig (Sep 28)