21
Mamba
Re: MyAds 2.x vulnerable!
  • 2006/7/5 4:25

  • Mamba

  • Moderator

  • Posts: 11409

  • Since: 2004/4/23


Quote:

phppp wrote:
Quote:

zyspec wrote:

I just looked at the source for the Japanese developed version (2.05 jp) and the specific problem identified has been fixed in this version.


If it's true, we should report it to secunia as a fault alarm.


Interestingly, it seems like the "SQL Injection" issue was discussed there in October 2005, and the main XOOPS Website was made aware of this issue only now. We need to work closer together so we are aware of security issues.
Support XOOPS => DONATE
Use 2.5.11 | Docs | Modules | Bugs

22
giba
Re: MyAds 2.x vulnerable!
  • 2006/7/5 12:59

  • giba

  • Just can't stay away

  • Posts: 638

  • Since: 2003/4/26



23
sailjapan
Re: MyAds 2.x vulnerable!

My code (MyAds 2.04) is different to that mentioned by zyspec below. It reads:
$yname = !empty($_POST['yname']) ? $myts->makeTboxData4Save($_POST['yname']) : "";
$ymail = !empty($_POST['ymail']) ? $myts->makeTboxData4Save($_POST['ymail']) : "";
$fname = !empty($_POST['fname']) ? $myts->makeTboxData4Save($_POST['fname']) : "";
$fmail = !empty($_POST['fmail']) ? $myts->makeTboxData4Save($_POST['fmail']) : "";

if(!isset(
$_POST['lid']) && isset($_GET['lid']) ) {
    
$lid intval($_GET['lid']) ;
}else {
    
$lid intval($_POST['lid']) ;
}

$op'';
if (!empty(
$_GET['op'])) {
    
$op $_GET['op'];
} elseif (!empty(
$_POST['op'])) {
    
$op $_POST['op'];
}


Any advice on what to edit out in this instance?

Cheers.

Quote:

zyspec wrote:
snip
Towards the bottom of the listing-p-f.php (or annonces-p-f.php depending on which version of MyAds you have) file you'll find the following code just before:

switch($op) {

You'll find:
foreach ($_POST as $k => $v) {
    ${
$k} = $v;
}

$lid = isset( $_GET['lid'] ) ? $_GET['lid'] : '' ;

if(!isset(
$_POST['op']) && isset($_GET['op']) ) {
    
$op $_GET['op'] ;
}


Just delete these lines or comment it out with // at the beginning of each line) and replace it with:

$lid = isset( $_GET['lid'] ) ? intval($_GET['lid']) : '' ;
$op = isset($_POST['op']) ? $_POST['op'] : '' ;
$op = isset($_GET['op']) ? $_GET['op'] : $op ;

$yname = isset($_POST['yname'] ? $myts->addSlashes($_POST['yname']) : '';
$ymail = isset($_POST['ymail'] ? $myts->addSlashes($_POST['ymail']) : '';
$fname = isset($_POST['fname'] ? $myts->addSlashes($_POST['fname']) : '';
$fmail = isset($_POST['fmail'] ? $myts->addSlashes($_POST['fmail']) : '';

Remember, place this BEFORE the switch($op) statement. By the way, the fix for the Job Listing module (jobs ver 1.9) is the same.
Never let a man who does not believe something can be done, talk to a man that is doing it.

24
zyspec
Re: MyAds 2.x vulnerable!
  • 2006/7/6 2:34

  • zyspec

  • Module Developer

  • Posts: 1095

  • Since: 2004/9/21


sailjapan,

The code you've shown above from your version is good enough to stop the SQL Injection vulnerability. You do not need to change anything in that code.

25
sailjapan
Re: MyAds 2.x vulnerable!

Cool.
Many thanks, zyspec.
Never let a man who does not believe something can be done, talk to a man that is doing it.

Login

Who's Online

355 user(s) are online (235 user(s) are browsing Support Forums)


Members: 0


Guests: 355


more...

Donat-O-Meter

Stats
Goal: $100.00
Due Date: Nov 30
Gross Amount: $0.00
Net Balance: $0.00
Left to go: $100.00
Make donations with PayPal!

Latest GitHub Commits