10
arie1985,
From the report on securityfocus.com it looks like the only XOOPS core 'vulnerability' is for the &get function in the XoopsGroupHandler. The other 4 (the one shown and the 3 'others') that it identified are in the Weblinks module.
the following line:
$sql = 'SELECT * FROM '.$this->db->prefix('groups').' WHERE groupid='.
$id;
could be changed to:
$sql = 'SELECT * FROM '.$this->db->prefix('groups').' WHERE groupid='.
intval($id);
although I'm not convinced this is a real vulnerability because of where it's located... I'd have to look at it more closely - maybe phppp or one of the core developers could elaborate. You might try posting this as a bug on the core dev site
here to see what they think.
