SpellingCow.com Improving forum spelling since... well not very long    FAQ   Search   Memberlist   Usergroups   Register   Profile   Log in to check your PM's   Log in  Forums | Home [fixed - sql injection!!] uh oh          SpellingCow.com Forum Index -> Bug Tracker View previous topic :: View next topic   Author Message Pickled_Weasel666 Joined: 28 May 2004 Posts: 104 Location: Oklahoma Posted: Fri Jul 02, 2004 11:09 am    Post subject: [fixed - sql injection!!] uh oh Error in obtaining dictionary words DEBUG MODE SQL Error : 1064 You have an error in your SQL syntax near 'll'' at line 3 SELECT * FROM phpbb_dictionary_words WHERE word = 'ya'll' Line : 335 File : /usr/local/www/data-dist/spell/public_html/phpBB2/spell.php got that when trying to add "ya'll" to the dictionary... I guess it doesn't like hick language _________________ Back to top Pickled_Weasel666 Joined: 28 May 2004 Posts: 104 Location: Oklahoma Posted: Fri Jul 02, 2004 11:46 am    Post subject: Error in obtaining dictionary words DEBUG MODE SQL Error : 1064 You have an error in your SQL syntax near 's'' at line 3 SELECT * FROM phpbb_dictionary_words WHERE word = 'Mine's' Line : 335 File : /usr/local/www/data-dist/spell/public_html/phpBB2/spell.php As I originally feared, it doesn't like apostrophes. _________________ Back to top nuttzy99 Site Admin Joined: 23 May 2004 Posts: 1068 Posted: Fri Jul 02, 2004 8:48 pm    Post subject: Fixed!!!! Damn, do you have any idea how big a find that is!?! Yes it breaks, but it is also a glaring security whole. Via a technique called SQL injection, it could have been possible to do anything from attaining password hashes to even deleting the entire DB! Good find... gold star for you -Nuttzy _________________ <?php echo "something wicked awesome for my sig"; ?> Back to top GPHemsley Joined: 27 May 2004 Posts: 139 Location: Long Beach, NY Posted: Fri Jul 02, 2004 11:30 pm    Post subject: nuttzy99 wrote: even deleting the entire DB! You gave the SpellingCow database user permission to delete databases? _________________ Gordon P. Hemsley A Link to the Past • CMSformE Back to top nuttzy99 Site Admin Joined: 23 May 2004 Posts: 1068 Posted: Fri Jul 02, 2004 11:41 pm    Post subject: GPHemsley wrote: nuttzy99 wrote: even deleting the entire DB! You gave the SpellingCow database user permission to delete databases? They could certainly empty all the tables which is the same thing in my opinion. No way of getting around that! -Nuttzy _________________ <?php echo "something wicked awesome for my sig"; ?> Back to top ZoliveR Joined: 27 May 2004 Posts: 80 Posted: Sat Jul 03, 2004 6:18 pm    Post subject: Happy to see that problems can be easily and quickly fixed Nuttzy you rock _________________ I'm the belgian chocolate eater Back to top nuttzy99 Site Admin Joined: 23 May 2004 Posts: 1068 Posted: Tue Jul 27, 2004 10:44 am    Post subject: Thanks Z Locking since this one is done and conversation is long over. -Nuttzy _________________ <?php echo "something wicked awesome for my sig"; ?> Back to top Display posts from previous: All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 Year Oldest FirstNewest First         SpellingCow.com Forum Index -> Bug Tracker All times are GMT - 5 Hours Page 1 of 1   Jump to: Select a forum General----------------AnnouncementsSay HelloGeneral DiscussionTesting As-you-type----------------Support The old POPUP version----------------Install TroublesThe War RoomSuccess StoriesSuggestionsBug TrackerDictionary Additions  You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum Powered by phpBB © 2001, 2002 phpBB Group :: Spelling by SpellingCow. SpellingCow.com Privacy Policy | blueGray theme by Nuttzy Sponsors: Identity Theft Protection - Compare identity theft protection services Structured Settlements - cash for structured settlements, sell annuity, lottery winnings, and more. Barcode Scanner Manufacturer - taiwan manufacturer of scanners, swipe card reader, serial-ethernet converter, cash drawer, and other pos devices. Advice, help & demonstrations for sign makers - Europe's leading sign makers website Tattoo - we are a group of tattoo enthusiasts