Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: [KAPDA::#16] - SMF SQL Injection
From: grudge () securityfocus com, simplemachines () securityfocus com, org () securityfocus com
Date: 10 Dec 2005 11:51:26 -0000

I'm a developer from over at simplemachines and I do not see how this can pose an exploit? Let's examine the code piece 
by piece:

The code is entered at this point:
if (!is_numeric($_REQUEST['start']))

So, will be executed if $_REQUEST['start'] is a string. It's then used in the query. However, it's used in the query in 
this piece of code:

substr(strtolower($_REQUEST['start']), 0, 1)

So, the string is set to lower case, and then only the FIRST letter is used within the query. How can anyone exploit 
the database with a one character insertion? Of course this is within single quotes as well, so it cannot even be a 
command.

I simply cannot see how you could possibly exploit SQL from this?


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]