Oh no! Where's the JavaScript?
Your Web browser does not have JavaScript enabled or does not support JavaScript. Please enable JavaScript on your Web browser to properly view this Web site, or upgrade to a Web browser that does support JavaScript.
Not a member yet? Click here to register.
Forgot Password?
  1. Home
  2. Discussion Forum
  3. PHPFusion 8 Support
  4. Suspected Bugs and Errors - 8
  5. HTML Usergroup Names vulnerable

HTML Usergroup Names vulnerable

Locked Asked Modified Viewed 2,726 times
Back to Forum Index Previous Topic Next Topic
Print
M
mongose
M
i44.tinypic.com/2r7lfkm.png
  • Junior Member, joined since
  • Contributed 15 posts on the community forums.
  • Started 2 threads in the forums
  • Started this discussions
asked
Junior Member

Code is vulnerable for sql injection

Code Download source
if(isset($_POST['save'])){
   $usergroup = $_POST['htmlname_usergroup'];
   $htmlname_html1 = $_POST['htmlname_html1'];
   $htmlname_html2 = $_POST['htmlname_html2'];
   $result3 = dbcount("(htmlname_usergroup)", DB_HTMLNAME_TABLE, "htmlname_usergroup = '".$usergroup."'");
   if($result3 != 0){
   $update = dbquery("UPDATE ".DB_HTMLNAME_TABLE." SET htmlname_html = '".$htmlname_html1."', htmlname_html2 = '".$htmlname_html2."' WHERE htmlname_usergroup = '".$usergroup."'");
   }else{
   $insert = dbquery("INSERT INTO ".DB_HTMLNAME_TABLE."  (htmlname_id, htmlname_usergroup, htmlname_html, htmlname_html2, use_group) VALUES (NULL, '".$usergroup."', '".$htmlname_html1."', '".$htmlname_html2."', '1');");
   }
   }
0 replies

9 posts

H
Homdax
H
Homdax 10
  • Fusioneer, joined since
  • Contributed 2,247 posts on the community forums.
  • Started 108 threads in the forums
answered
Fusioneer

Example? Source?
0 replies
M
mongose
M
i44.tinypic.com/2r7lfkm.png
  • Junior Member, joined since
  • Contributed 15 posts on the community forums.
  • Started 2 threads in the forums
  • Started this discussions
answered
Junior Member

http://www.php-fusion.co.uk/infusions/addondb/view.php?addon_id=470

for stripinput is need on the filter clean before on file admin htmlnames_admin.php

$usergroup = stripinput($_POST['htmlname_usergroup']);
$htmlname_html1 = stripinput($_POST['htmlname_html1']);
$htmlname_html2 = stripinput($_POST['htmlname_html2']);

for on infusion.php is bad the number value is big.

htmlname_usergroup VARCHAR( 255 ) NOT NULL,
htmlname_html TEXT NOT NULL,
htmlname_html2 TEXT NOT NULL,

varchar 255 big text not null big
0 replies
G
gh0st2k
G
Ex Senior Dev.
  • Member, joined since
  • Contributed 131 posts on the community forums.
answered
Member

Don't hurry up, the input should be checked, but it is not a security vulnerable. You have to have admin rights for this infusion.
All table columns have wrong / too big values ;)
0 replies
M
mongose
M
i44.tinypic.com/2r7lfkm.png
  • Junior Member, joined since
  • Contributed 15 posts on the community forums.
  • Started 2 threads in the forums
  • Started this discussions
answered
Junior Member

if to receive administrator password is bad on it.
0 replies
G
gh0st2k
G
Ex Senior Dev.
  • Member, joined since
  • Contributed 131 posts on the community forums.
answered
Member

When you have got admin access, you can do what you want (custom pages, panels, and so on).
0 replies
M
mongose
M
i44.tinypic.com/2r7lfkm.png
  • Junior Member, joined since
  • Contributed 15 posts on the community forums.
  • Started 2 threads in the forums
  • Started this discussions
answered
Junior Member

If not on administrator only find her password is problem form look in direction of database and user can reject password decryption for her password and she wants to enter it for user info panel she have access upon the side of administrator.
0 replies
G
gh0st2k
G
Ex Senior Dev.
  • Member, joined since
  • Contributed 131 posts on the community forums.
answered
Member

Oh man stop arguing about this topic, I don't understand it and you're right, it should be fixed, but it is not a big deal...
0 replies
M
mongose
M
i44.tinypic.com/2r7lfkm.png
  • Junior Member, joined since
  • Contributed 15 posts on the community forums.
  • Started 2 threads in the forums
  • Started this discussions
answered
Junior Member

dears help situations under the ties for author secure.
0 replies
H
Homdax
H
Homdax 10
  • Fusioneer, joined since
  • Contributed 2,247 posts on the community forums.
  • Started 108 threads in the forums
answered
Fusioneer

Thread is not very clear to say the least. Mongose's response is very hard to understand. Question asked and answered, this is not a security issue.

Locked.

Mongose, if you are having a hard time with the language, please make some effort using google translate or some other tool.
0 replies

Category Forum

Suspected Bugs and Errors - 8

Labels

None yet

Statistics

  • Views 0 views
  • Posts 9 posts
  • Votes 0 votes
  • Topic users 3 members

3 participants

H
H
Homdax 10
  • Fusioneer, joined since
  • Contributed 2,247 posts on the community forums.
  • Started 108 threads in the forums
G
G
Ex Senior Dev.
  • Member, joined since
  • Contributed 131 posts on the community forums.
M
M
i44.tinypic.com/2r7lfkm.png
  • Junior Member, joined since
  • Contributed 15 posts on the community forums.
  • Started 2 threads in the forums
  • Started this discussions

Notifications

Track thread

You are not receiving notifications from this thread.

Related Questions

Not yet