Crimor
Newbie
Registrato: May 30, 2005
Messaggi: 53
Localitą: Milano
|
 Inviato: 01-06-2005 18:31 Oggetto: Grave bug in NukeSentinel |
 |
|
E' stato rilevato un bug in Nuke Sentinel.
In poche parole, sentinel non blocca alcune SQL Injection scritte in un certo modo.
Risolviamo questo problema aprendo il file includes/nukesentinel.php
Trovate:
| Codice: | if (stristr($nsnst_const['query_string'],'%20union%20') OR stristr($nsnst_const['query_string'],'*/union/*') OR
stristr($nsnst_const['query_string'],' union ') OR stristr($nsnst_const['query_string_base64'],'%20union%20') OR
stristr($nsnst_const['query_string_base64'],'*/union/*') OR stristr($nsnst_const['query_string_base64'],' union ')) { |
e sostituite con:
| Codice: | if (stristr($nsnst_const['query_string'],'+union+') OR stristr($nsnst_const['query_string'],'%20union%20') OR
stristr($nsnst_const['query_string'],'*/union/*') OR stristr($nsnst_const['query_string'],' union ') OR
stristr($nsnst_const['query_string_base64'],'+union+') OR stristr($nsnst_const['query_string_base64'],'%20union%20') OR
stristr($nsnst_const['query_string_base64'],'*/union/*') OR stristr($nsnst_const['query_string_base64'],' union ')) { |
Per la versione vecchia di Sentinel:
Trovate l'istruzione simile a quella riportata sopra.
Sostituitela con questo codice:
| Codice: | if (stristr($query_string,'+union+') OR stristr($query_string,'%20union%20') OR
stristr($query_string,'*/union/*') OR stristr($query_string,' union ') OR
stristr($query_string_base64,'+union+') OR stristr($query_string_base64,'%20union%20') OR
stristr($query_string_base64,'*/union/*') OR stristr($query_string_base64,' union ')) { |
|
|
FAQ
Cerca
Gruppi utenti
Profilo
Messaggi Privati
Login
