Welcome to Geeklog, Anonymous Monday, October 02 2023 @ 10:55 am EDT

Comments for Current Security Issues (Sept 2003)

Current Security Issues (Sept 2003) | 29 comments | Create New Account

The following comments are owned by whomever posted them. This site is not responsible for what they say.

Current Security Issues (Sept 2003)

Authored by: Blaine on Friday, October 10 2003 @ 08:05 pm EDT

It appears this python attack was run against the new (un-released) membership.php that I was testing on this site and have distributed to a few users for testing.

I had enhanced (albeit now see the issue) to sort the display to improve it's usefullness. I've tried to inject SQL to add the order by clause in the current 2.2 release and was not able.
I'm able to force the ORDER BY SQL clause to be added to the sql statement but it is rejected as improper SQL syntax.

This was tested on MYSQL 3.23. I've not heard that anyone has done this on the released forum 2.2 release code.

I will be adding logic to filter out any SQL from being added on the URL path.

To filter out any Javascript and IMG tags with JS - just enable the GL Filter and ensure the IMG tag (and other potential XSS supported tags) are not allowable HTML.

Blaine

---
Geeklog components by PortalParts -- www.portalparts.com

Warning: Javascript required to enable functionality

Post a Comment

Search

Resources

About

Getting started

Support

Development

Topics

User Functions

What's New

Articles last 4 weeks

Comments last 4 weeks

Pages last 4 weeks

Links last 4 weeks

Downloads last 4 weeks