phpBMS

Show
Ignore:
Timestamp:
01/01/10 23:10:02 (2 years ago)
Author:
brieb
Message:
  • Fixed several SQL injection vulnerabilities
  • Fixed several XSS vulnerabilities due to PHP_SELF and REQUREST_URI
  • Fixed severa path disclosure errors
Files:
1 modified

Legend:

Unmodified
Added
Removed
  • trunk/phpbms/dbgraphic.php

    r702 r704  
    3737 +-------------------------------------------------------------------------+ 
    3838*/ 
    39         session_cache_limiter('private'); 
    40         require_once("include/session.php"); 
     39session_cache_limiter('private'); 
     40require_once("include/session.php"); 
    4141 
    42         if(!isset($_GET["t"]) or !isset($_GET["r"]) or !isset($_GET["f"]) or !isset($_GET["mf"])) die("Invalid Parameters Set"); 
     42if(!isset($_GET["t"]) or !isset($_GET["r"])) 
     43    $error = new appError(200, "passed parameters not set"); 
    4344 
    44         $querystatement="SELECT ".$_GET["f"].",".$_GET["mf"]." FROM ".$_GET["t"]." WHERE id=".$_GET["r"]; 
    45         $queryresult=$db->query($querystatement); 
    46         if(!$queryresult) die("bad query".$querystatement); 
    47         if($db->numRows($queryresult)){ 
    48                 $therecord=$db->fetchArray($queryresult); 
    49                 header('Content-type: '.$therecord[$_GET["mf"]]); 
     45switch($_GET["t"]){ 
    5046 
    51                 echo $therecord[$_GET["f"]]; 
    52         } 
     47    case "productThumb": 
     48        $table = "products"; 
     49        $fileField = "thumbnail"; 
     50        $mimeField = "thumbnailmime"; 
     51 
     52    case "productPic": 
     53        $table = "products"; 
     54        $fileField = "picture"; 
     55        $mimeField = "picturemime"; 
     56 
     57        break; 
     58 
     59    case "file": 
     60        $table = "files"; 
     61        $fileField = "file"; 
     62        $mimeField = "type"; 
     63        break; 
     64 
     65}//endswitch 
     66 
     67$id = (int) $_GET["r"]; 
     68 
     69$querystatement = " 
     70    SELECT 
     71        `".$fileField."` AS theFile, 
     72        `".$mimeField."` AS theMime 
     73    FROM 
     74        ".$table." 
     75    WHERE 
     76        id = ".$_GET["r"]; 
     77 
     78$queryresult = $db->query($querystatement); 
     79 
     80if($db->numRows($queryresult)){ 
     81 
     82    $therecord = $db->fetchArray($queryresult); 
     83 
     84    header('Content-type: '.$therecord["theMime"]); 
     85 
     86    echo $therecord["theFile"]; 
     87 
     88}//end if 
    5389?> 
phpBMS vulnerability assesment provided by Orvant Inc. Copyright © 2010 Kreotek, LLC. All Rights reserved.