BugTraq
Back to list
|
Post reply
Re: mybb v1.1.1(rss.php) SQL Injection Exploit
May 25 2006 05:52AM
Steven M. Christey (coley mitre org)
>Foud By: Breeeeh & CrAzY CrAcKeR
>$comma = " - ";
>...
>$title .= $comma.$forum['name'];
>...
>$comma = ", ";
This code snippet sets the $comma variable to static values, so it
doesn't look like the attacker can control them.
>Example:
>
>/rss.php?...$comma=[SQL]
Given the previous code snippet, how can $comma be modified from this
URL?
- Steve
[ reply ]
Privacy Statement
Copyright 2010, SecurityFocus
>Foud By: Breeeeh & CrAzY CrAcKeR
>$comma = " - ";
>...
>$title .= $comma.$forum['name'];
>...
>$comma = ", ";
This code snippet sets the $comma variable to static values, so it
doesn't look like the attacker can control them.
>Example:
>
>/rss.php?...$comma=[SQL]
Given the previous code snippet, how can $comma be modified from this
URL?
- Steve
[ reply ]