Re: Woltlab Burning Board 2.3.X SQL Injection Vulnerability
- From: x82_@xxxxx
- Date: 24 Sep 2006 08:48:21 -0000
funny advisory.. ;)
Here is our fix:
-------------------------------------
if ($_GET['page'] < "0")
{
$this->page = 1;
}
-------------------------------------
Add this near line 480 in function getPostIds()
And by the way this isn't critical, because intval is used before, not because it's ORDER BY... ;)
best regards,
x82
- Prev by Date: Local File Inclusion : Kietu
- Next by Date: [security bulletin] HPSBUX02152 SSRT5973 rev.1 - HP-UX Kerberos Client Remote Unauthenticated Execution of Arbitrary Code
- Previous by thread: Re: Re: Woltlab Burning Board 2.3.X SQL Injection Vulnerability
- Next by thread: [Call for Papers] DIMVA 2007
- Index(es):
