Resources

Getting started

Support

Development

Topics

User Functions

Events

There are no upcoming events

What's New

Stories

1 new Stories in the last 2 weeks

Comments last 2 weeks


Trackbacks last 2 weeks

No new trackback comments

Links last 2 weeks

No recent new links

NEW FILES last 14 days

No new files

Welcome to Geeklog Saturday, May 25 2013 @ 10:56 PM EDT

> >

Webservices exploit

Security
  • Thursday, April 09 2009 @ 03:50 PM EDT
  • Contributed by:
  • Views:
    7,636

Well, it's getting a bit embarrassing, but here goes:

Bookoo of the Nine Situations Group posted another SQL injection exploit, this time targetting the webservices API in Geeklog. The problem exists in all 1.5.x releases to date. Fortunately, it can be avoided by disabling the webservices like so: Go to

Configuration > Geeklog > Miscellaneous > Webservices

(that's the last set of options on the "Miscellaneous" page) and set "Disable Webservices?" to "True". We'll release an fix ASAP, but this should secure your site for now.

What's Related

Story Options

Trackback

Trackback URL for this entry:
http://www.geeklog.net/trackback.php/webservices-exploit

Here's what others have to say about 'Webservices exploit':

[...] el valor de FalseMás información a través de este enlace:http://www.geeklog.net/article.php/webservices-exploit/div> Trackback Trackback URL for this entry: [...] [read more]

[...] Monday, April 13 2009 @ 11:55 AM EDT Contributed by: Dirk Views: 2 Geeklog 1.5.2sr3 addresses the recently published exploit for an SQL injection in the webservices. It is available for download as a complete tarball, for fresh installs and [...] [read more]

[...] the RSS feed to make sure you don't miss a thing on cmscritic.com!Geeklog 1.5.2sr3 addresses the recently published exploit for an SQL injection in the webservices. It is available for download as a complete tarball, for fresh installs and [...] [read more]

[...] update, bundling all the changes for 1.5.2sr1 - 1.5.2sr4. Geeklog 1.5.2sr3 addresses the recently published exploit for an SQL injection in the webservices. It is available for download as a complete tarball, for fresh installs and upgrades [...] [read more]

The following comments are owned by whomever posted them. This site is not responsible for what they say.

Post a Comment

Your Name
Create Account
Allowed HTML Tags:
<p>, <b>, <strong>, <i>, <a>, <em>, <br>, <tt>, <hr>, <li>, <ol>, <ul>, <code>, <pre>, [code], [raw], [page_break], [staticpage:]InformationInformation[staticpage: id alternate title] - Displays a link to a static page using the static page title as the title. An alternate title may be specified but is not required. , [event:]InformationInformation[event: id alternate title] - Displays a link to an Event Link from the Calendar using the Event Title as the title. An alternate title may be specified but is not required. , [poll:]InformationInformation[poll: id alternate title] - Displays a link to a poll using the Poll Topic as the title. An alternate title may be specified but is not required. , [link:]InformationInformation[link: id alternate title] - Displays a link to a Link from the Links Plugin using the Link Title as the title. An alternate title may be specified but is not required. , [faq:], [forum:]InformationInformation[forum: id alternate title] - Displays a link to a forum topic using the text 'here' as the title. An alternate title may be specified but is not required. , [file:], [story:]InformationInformation[story: id alternate title] - Displays a link to a Story using the Story Title as the title. An alternate title may be specified but is not required. , [user:]InformationInformation[user: name alternate title] - Displays a link to a User using the Username as the title. An alternate title may be specified but is not required.
 

Security code
This question is for testing whether you are a human visitor and to prevent automated spam submissions.

What code is in the image?
Enter the bolded text, case sensitive!
Important Stuff
  • Please try to keep posts on topic.
  • Try to reply to other people comments instead of starting new threads.
  • Read other people's messages before posting your own to avoid simply duplicating what has already been said.
  • Use a clear subject that describes what your message is about.
  • Your email address will NOT be made public.