[轉貼]phpBB 2.0.5 的潛在性 SQL 弱點
發表於 : 2003-06-22 08:14
http://www.phpbb.com/phpBB/viewtopic.php?t=112052
如果你對此有所疑慮,你可以參考以下的修正方式。
open viewtopic.php
-----------------------------------------------------------------------------------------
尋找\r
在前面加上
在下面尋找\r
更改為\r
完成。
-----------------------------------------------------------------------------------------
關於 "SQL injection vulnerability",你可以透過Google來查詢相關訊息。
"SQL injection vulnerability" 資料庫查詢植入攻擊,phpBB 官網在 6 月 20 日公布了這個訊息,不過因為各個伺服器都有著不同的防護措施,使得這個問題只會在某些伺服器上發生。psoTFX 寫:We've been informed that a possible SQL injection vulnerability has been released to various lists and sites. The issue is unlikely to affect many users given the requirements that surround it.
如果你對此有所疑慮,你可以參考以下的修正方式。
open viewtopic.php
-----------------------------------------------------------------------------------------
尋找\r
代碼: 選擇全部
if ( isset($HTTP_GET_VARS[POST_TOPIC_URL]) )
{
$topic_id = intval($HTTP_GET_VARS[POST_TOPIC_URL]);
}
else if ( isset($HTTP_GET_VARS['topic']) )
{
$topic_id = intval($HTTP_GET_VARS['topic']);
}
代碼: 選擇全部
$topic_id = $post_id = false;
代碼: 選擇全部
$join_sql_table = ( !isset($post_id) ) ? '' : ", " . POSTS_TABLE . " p, " . POSTS_TABLE . " p2 ";
$join_sql = ( !isset($post_id) ) ? "t.topic_id = $topic_id" : "p.post_id = $post_id AND t.topic_id = p.topic_id AND p2.topic_id = p.topic_id AND p2.post_id <= $post_id";
$count_sql = ( !isset($post_id) ) ? '' : ", COUNT(p2.post_id) AS prev_posts";
$order_sql = ( !isset($post_id) ) ? '' : "GROUP BY p.post_id, t.topic_id, t.topic_title, t.topic_status, t.topic_replies, t.topic_time, t.topic_type, t.topic_vote, t.topic_last_post_id, f.forum_name, f.forum_status, f.forum_id, f.auth_view, f.auth_read, f.auth_post, f.auth_reply, f.auth_edit, f.auth_delete, f.auth_sticky, f.auth_announce, f.auth_pollcreate, f.auth_vote, f.auth_attachments ORDER BY p.post_id ASC";
代碼: 選擇全部
$join_sql_table = ( empty($post_id) ) ? '' : ", " . POSTS_TABLE . " p, " . POSTS_TABLE . " p2 ";
$join_sql = ( empty($post_id) ) ? "t.topic_id = $topic_id" : "p.post_id = $post_id AND t.topic_id = p.topic_id AND p2.topic_id = p.topic_id AND p2.post_id <= $post_id";
$count_sql = ( empty($post_id) ) ? '' : ", COUNT(p2.post_id) AS prev_posts";
$order_sql = ( empty($post_id) ) ? '' : "GROUP BY p.post_id, t.topic_id, t.topic_title, t.topic_status, t.topic_replies, t.topic_time, t.topic_type, t.topic_vote, t.topic_last_post_id, f.forum_name, f.forum_status, f.forum_id, f.auth_view, f.auth_read, f.auth_post, f.auth_reply, f.auth_edit, f.auth_delete, f.auth_sticky, f.auth_announce, f.auth_pollcreate, f.auth_vote, f.auth_attachments ORDER BY p.post_id ASC";
-----------------------------------------------------------------------------------------
關於 "SQL injection vulnerability",你可以透過Google來查詢相關訊息。