I recently found out that someone I knew was running this vuln

application. After informing them it was vuln they were dissapointed at

the fact that they could no longer use the program as the author has not

supplied a fix. Anyway, here is a quick fix i threw together to take care

of the problem. Basically it eregs the input to only allow numbers, and

checks to make sure the number is no greater than 10 and no less than 1.

I also closed off the variable in the SQL query that was allowing the SQL

injection to be possible. Get the fix here

http://www.gulftech.org/vuln/pafiledbsqlfix.zip

This should solve any problems encountered until the vendor releases

an "official" fix or a new version of PaFileDB.

Cheers,

JeiAr

----------------------------------------

GulfTech Computers

http://www.gulftech.org

[ reply ]