Re: SQL injection in Invision Power Board v2.1.5

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: Re: SQL injection in Invision Power Board v2.1.5
From: mattmecham@xxxxxxxxx
Date: 7 Mar 2006 10:07:28 -0000
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm

I've tested this and cannot get SQL to execute. The "s" parameter is run past 
PHP's intval() which knocks off anything that's not a number.

Can you explain how you got this to work?

Prev by Date: [SECURITY] [DSA 987-1] New tar packages fix arbitrary code execution
Next by Date: IM Lock 2006 - Insecure Registry Permission Vulnerability
Previous by thread: SQL injection in Invision Power Board v2.1.5
Next by thread: Re: SQL injection in Invision Power Board v2.1.5
Index(es):
- Date
- Thread