|
Removed
Link Here
|
| 1 |
--- privmsg.php 2004-03-18 19:51:32.000000000 +0000 |
| 2 |
+++ privmsg.1.php 2004-03-26 19:51:07.000000000 +0000 |
| 3 |
@@ -212,7 +212,17 @@ |
| 4 |
break; |
| 5 |
case 'savebox': |
| 6 |
$l_box_name = $lang['Savebox']; |
| 7 |
- $pm_sql_user .= "AND ( ( pm.privmsgs_to_userid = " . $userdata['user_id'] . " |
| 8 |
+ |
| 9 |
+ // |
| 10 |
+ // For some obscure reason, the assignment |
| 11 |
+ // concatenation operator was coded below, which |
| 12 |
+ // allowed an attacker to append arbitrary SQL code |
| 13 |
+ // to the end of the $pm_sql_user variable. |
| 14 |
+ // This is fixed below. |
| 15 |
+ // |
| 16 |
+ // -shaun2k2 |
| 17 |
+ // |
| 18 |
+ $pm_sql_user = "AND ( ( pm.privmsgs_to_userid = " . $userdata['user_id'] . " |
| 19 |
AND pm.privmsgs_type = " . PRIVMSGS_SAVED_IN_MAIL . " ) |
| 20 |
OR ( pm.privmsgs_from_userid = " . $userdata['user_id'] . " |
| 21 |
AND pm.privmsgs_type = " . PRIVMSGS_SAVED_OUT_MAIL . " ) |