Re: [waraxe-2007-SA#053] - Critical Sql Injection in NukeSentinel 2.5.11
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5125
Same as mine:
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1171
[me]
# +nsbypass.php
# 16. $tid = intval($tid);
# 17. if(isset($_COOKIE['admin']) && !empty($_COOKIE['admin'])) {
# 18. $abadmin = base64_decode($_COOKIE['admin']);
# 19. $abadmin = explode(":", $abadmin);
# 20. $a_aid = "$abadmin[0]";
# 21. $a_pas = "$abadmin[1]";
# 22. }
#....
# +nsbypass.php
# 24. $num = $db->sql_numrows($db->sql_query("SELECT * FROM
".$prefix."_authors WHERE `aid`='$a_aid' AND `pwd`='$a_pas'"));
# 25. $tum = $db->sql_numrows($db->sql_query("SELECT * FROM
".$prefix."_nsnst_tracked_ips WHERE `tid`='$tid'"));
#
[you]
----------->[source code]<------------
if(isset($_COOKIE['admin']) && !empty($_COOKIE['admin'])) {
$abadmin = base64_decode($_COOKIE['admin']);
$abadmin = explode(":", $abadmin);
$a_aid = "$abadmin[0]";
$a_pas = "$abadmin[1]";
}
$num = $db->sql_numrows($db->sql_query("SELECT * FROM ".$prefix."_authors
WHERE `aid`='$a_aid' AND `pwd`='$a_pas'"));
------------>[/source code]<-----------