Bugzilla – Attachment 40956 Details for
Bug 14521
SQL injection in local use system preferences
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 14521 - SQL injection in local use system preferences
Bug-14521---SQL-injection-in-local-use-system-pref.patch (text/plain), 1.77 KB, created by
Chris Cormack
on 2015-07-13 04:16:58 UTC
(
hide
)
Description:
Bug 14521 - SQL injection in local use system preferences
Filename:
MIME Type:
Creator:
Chris Cormack
Created:
2015-07-13 04:16:58 UTC
Size:
1.77 KB
patch
obsolete
>From 466d751a63fa24cf55d3e026aa819eaec9093e77 Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Mon, 13 Jul 2015 14:06:46 +1000 >Subject: [PATCH] Bug 14521 - SQL injection in local use system preferences > >This patch fixes a SQL injection vulnerability in the local use >system preferences. > >_TEST PLAN_ > >Before applying: > >1) Go to Global System Preferences >2) Click on the "Local use" tab >3) Add a new preference with the value "') or '1' = '1' -- " >(be sure to include the space at the end after the comment --). >4) When the page refreshes, you should now see about 99 other system >preferences which shouldn't be showing up. > >5) Apply the patch > >6) Refresh the page >7) Note that you now only see a system preference for "') or '1' = '1' -- " >and the other actual local use system preferences. > >Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> >--- > admin/systempreferences.pl | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > >diff --git a/admin/systempreferences.pl b/admin/systempreferences.pl >index 68bff18..1c3dd41 100755 >--- a/admin/systempreferences.pl >+++ b/admin/systempreferences.pl >@@ -70,14 +70,16 @@ sub StringSearch { > > my $strsth = "Select variable,value,explanation,type,options from systempreferences where variable in ("; > my $first = 1; >+ my @sql_bind; > for my $name ( get_local_prefs() ) { > $strsth .= ',' unless $first; >- $strsth .= "'$name'"; >+ $strsth .= "?"; >+ push(@sql_bind,$name); > $first = 0; > } > $strsth .= ") order by variable"; > $sth = $dbh->prepare($strsth); >- $sth->execute(); >+ $sth->execute(@sql_bind); > > while ( my $data = $sth->fetchrow_hashref ) { > unless (defined $data->{value}) { $data->{value} = "";} >-- >2.1.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 14521
:
40955
|
40956
|
40964