SQL Injection Vulnerabilities!

sixonetonoffun · Posted: Wed May 05, 2004 8:27 pm

Ok I only tried on the most recent files didn't apply the extra code changes.

chatserv · Posted: Wed May 05, 2004 8:45 pm

Code:

$result=sql_query("SELECT lid, url, title, description, date, hits, downloadratingsummary, totalvotes, totalcomments, filesize, version, homepage FROM ".$prefix."_downloads_downloads WHERE sid=$sid order by $orderby limit $min,$perpage", $dbi);

Change to:

Code:

$result=sql_query("SELECT lid, url, title, description, date, hits, downloadratingsummary, totalvotes, totalcomments, filesize, version, homepage FROM ".$prefix."_downloads_downloads WHERE sid='$sid' order by $orderby limit $min,$perpage", $dbi);

sixonetonoffun · Posted: Wed May 05, 2004 9:28 pm

Yeah that does it wonders.

sixonetonoffun · Posted: Thu May 06, 2004 5:12 am

In 7.2 its a little different too.

Code:

$result=$db->sql_query("SELECT lid, url, title, description, date, hits, downloadratingsummary, totalvotes, totalcomments, filesize, version, homepage FROM ".$prefix."_downloads_downloads WHERE sid=$sid order by $orderby limit $min,$perpage");

manunkind · Posted: Thu May 06, 2004 6:29 am

Anybody know if NS Download is safe from these exploits?

chatserv · Posted: Thu May 06, 2004 7:31 am

For that particular line just search for WHERE sid=$sid and replace with WHERE sid='$sid' (add quotes to the $sid variable)

sixonetonoffun · Posted: Thu May 06, 2004 2:27 pm

Yeah I'd check out any modules that where based on the original closely there is a good chance this was missed in some along the way.