Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
[Full-disclosure] Re: [waraxe-2005-SA#041] - Critical Sql Injection in PhpNuke 6.x-7.6 Top module
From: Paul Laudanski (zxcastlecops.com)
Date: Sat Apr 09 2005 - 00:20:35 CDT
On 7 Apr 2005, Janek Vind wrote:
> ... and as result we can see md5 hashes of all the admin passwords in place, where normally
> top 10 votes can be seen :)
Again as before, code should be validating input. But as a simple
precaution against default GET attacks, changing the table prefix from the
common "nuke_" to something random like "zloqf7_" would render that
sample, and all others based on "nuke_" useless.
Of course in the grander scheme that isn't foolproof, but does work
against the default GETs.
Paul Laudanski .. Computer Cops, LLC.
Microsoft MVP Windows-Security 2005
CC Blog ......... http://blog.castlecops.com
Staff Blogs ..... http://busterbunny.castlecops.com
Our Vision ...... http://castlecops.com/postt63382.html
http://cuddlesnkisses.com http://justalittlepoke.com http://zhen-xjell.com
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/