Re: [waraxe-2007-SA#053] - Critical Sql Injection in NukeSentinel 2.5.11

From: <gmdarkfig(at)gmail.com>
Date: Fri Sep 28 2007 - 03:20:59 EDT

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5125 Same as mine:
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1171

[me]
# +nsbypass.php
# 16. $tid = intval($tid);
# 17. if(isset($_COOKIE['admin']) && !empty($_COOKIE['admin'])) {
# 18. $abadmin = base64_decode($_COOKIE['admin']);
# 19. $abadmin = explode(":", $abadmin);
# 20. $a_aid = "$abadmin[0]";
# 21. $a_pas = "$abadmin[1]";
# 22. }
#....
# +nsbypass.php
# 24. $num = $db->sql_numrows($db->sql_query("SELECT * FROM
".$prefix."_authors WHERE `aid`='$a_aid' AND `pwd`='$a_pas'"));
# 25. $tum = $db->sql_numrows($db->sql_query("SELECT * FROM
".$prefix."_nsnst_tracked_ips WHERE `tid`='$tid'"));
#

[you]
----------->[source code]<------------
if(isset($_COOKIE['admin']) && !empty($_COOKIE['admin'])) {

$abadmin = base64_decode($_COOKIE['admin']);
$abadmin = explode(":", $abadmin);
$a_aid = "$abadmin[0]";
$a_pas = "$abadmin[1]";

}
$num = $db->sql_numrows($db->sql_query("SELECT * FROM ".$prefix."_authors WHERE `aid`='$a_aid' AND `pwd`='$a_pas'")); ------------>[/source code]<----------- Received on Fri Sep 28 12:05:13 2007