Hi,
There is a sql injection in Xoops 2.0.14 (and maybe before versions) .
One of the user inputs, is used in the sql query without proper checking :
File /edituser.php, Line 347 :
:: if (!empty($_POST['user_avatar'])) {
>> $user_avatar = trim($_POST['user_avatar']);
:: $criteria_avatar = new CriteriaCompo(new Criteria('avatar_file', $user_avatar));
:: $criteria_avatar->add(new Criteria('avatar_type', "S"));
:: $avatars =& $avt_handler->getObjects($criteria_avatar);
:: if (!is_array($avatars) || !count($avatars)) {
:: $user_avatar = 'blank.gif';
:: }
The bug can be critical, so no more info .
You can upgrade to 2.0.15 .
Also, a simple solution is to change line 348 of /edituser.php, to :
$user_avatar = addslashes(trim($_POST['user_avatar']));
The original advisory (in Persian), is located at :
http://www.hackers.ir/advisories/xoops.html
- Omid
This information is provided for TESTING and LEGAL RESEARCH purposes only. All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum