Re: Woltlab Burning Board 2.3.X SQL Injection Vulnerability

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



funny advisory.. ;)
Here is our fix:

-------------------------------------
if ($_GET['page'] < "0") 
{
  $this->page = 1;
}
-------------------------------------

Add this near line 480 in function getPostIds()
And by the way this isn't critical, because intval is used before, not because it's ORDER BY... ;)


best regards,

x82

[Index of Archives]     [Linux Security]     [Netfilter]     [PHP]     [Yosemite News]     [Linux Kernel]

  Powered by Linux