Skip to content

Commit

Permalink
Migrate to mysqli
Browse files Browse the repository at this point in the history 
Migrate all mysql to mysqli for apply patch wyth
mysqli_real_escape_string
  • Loading branch information
LaboCnil committed Nov 4, 2014
1 parent 7f68b22 commit 4978326
Show file tree
Hide file tree
Showing 6 changed files with 26 additions and 21 deletions.
3 changes: 1 addition & 2 deletions cookieviz/clear.php
View file
Expand Up @@ -19,7 +19,6 @@

require "connect.php";

$query = "TRUNCATE url_referer";
$result = mysql_query($query) or die ("Echec de la requête : ".query." ". mysql_error());
$link->query("TRUNCATE url_referer");
require "disconnect.php";
?>
8 changes: 5 additions & 3 deletions cookieviz/connect.php
View file
Expand Up @@ -21,7 +21,9 @@
$mdp = fgets($fp);
fclose($fp);

$link = mysql_connect('localhost', 'root', $mdp)
or die('Impossible de se connecter : ' . mysql_error());
mysql_select_db('CookieViz') or die('Impossible de sélectionner la base de données');
$link = new mysqli('localhost', 'root', $mdp, 'CookieViz');
if (mysqli_connect_errno())
{
printf("Connect failed: %s\n", mysqli_connect_error());
}
?>
2 changes: 1 addition & 1 deletion cookieviz/disconnect.php
View file
Expand Up @@ -17,5 +17,5 @@
*/


mysql_close($link) or die('Impossible de se déconnecter : ' . mysql_error());
$link->close();
?>
16 changes: 9 additions & 7 deletions cookieviz/info.php
View file
Expand Up @@ -20,7 +20,7 @@

if(isset($_GET["domain"]))
{
$domain = mysqli_real_escape_string($_GET["domain"]);
$domain = mysqli_real_escape_string($link, $_GET["domain"]);

}
else
Expand All @@ -37,9 +37,10 @@
echo "</tr>";
echo "</thead>";
echo "<tbody>";
$query="SELECT * FROM url_referer WHERE referer_domains='".$domain."'GROUP BY url_domains, referer_domains";
$result = mysql_query($query) or die ("Echec de la requête : ".$query." ". mysql_error());
while ($line = mysql_fetch_assoc($result))
$query=$link->prepare("SELECT * FROM url_referer WHERE referer_domains='".$domain."'GROUP BY url_domains, referer_domains");

This comment has been minimized.

Sign in to view

Copy link
@pomeh

pomeh Nov 4, 2014

bind_param method should be used instead of inlining values. See http://php.net/manual/en/mysqli.prepare.php#refsect1-mysqli.prepare-examples and http://mattbango.com/notebook/code/prepared-statements-in-php-and-mysqli/. And then, mysqli_real_escape_string could be skipped (not 100% sure about that though).

This comment has been minimized.

Sign in to view

Copy link
@LaboCNIL

LaboCNIL Nov 4, 2014

Collaborator

Ok, I will change that in the future version. Did you think usage of mysqli_real_escape_string would be enough ? I have to publish fast my patch

This comment has been minimized.

Sign in to view

Copy link
@pomeh

pomeh Nov 4, 2014

Yes it might be a good start to fix injection flaws, but not the best way IMO.
$query->execute();
$result = $query->get_result();
while ($line = $result->fetch_assoc())
{
echo "<tr>";
if ($line["is_cookie"] == 1)
Expand All @@ -50,9 +51,10 @@
}
echo "</tr>";
}
$query="SELECT * FROM url_referer WHERE url_domains='".$domain."'GROUP BY url_domains, referer_domains";
$result = mysql_query($query) or die ("Echec de la requête : ".$query." ". mysql_error());
while ($line = mysql_fetch_assoc($result))
$query=$link->prepare("SELECT * FROM url_referer WHERE url_domains='".$domain."'GROUP BY url_domains, referer_domains");
$query->execute();
$result = $query->get_result();
while ($line = $result->fetch_assoc())
{
echo "<tr>";
if ($line["is_cookie"] == 1)
Expand Down
6 changes: 3 additions & 3 deletions cookieviz/json.php
View file
Expand Up @@ -23,7 +23,7 @@

if(isset($_GET["max_date"]))
{
$init_max_date = mysqli_real_escape_string($_GET["max_date"]);
$init_max_date = mysqli_real_escape_string($link, $_GET["max_date"]);
if (!is_numeric($init_max_date))
{
$init_max_date="";
Expand All @@ -32,11 +32,11 @@

if(isset($_GET["domain"]))
{
$domain = mysqli_real_escape_string($_GET["domain"]);
$domain = mysqli_real_escape_string($link, $_GET["domain"]);
}

$max_date = $init_max_date;
$point_map = new point_map($domain);
$point_map = new point_map($domain, $link);
$map = $point_map->get_map();
$write_nodes='[';
$write_links='[';
Expand Down
12 changes: 7 additions & 5 deletions cookieviz/load_point.php
View file
Expand Up @@ -26,18 +26,20 @@ class point_map
var $reference;
var $last_date;
var $domain;
function __construct($domain)
function __construct($domain, $link)
{
$this->domain = $domain;
$this->load_query = "SELECT * FROM url_referer GROUP BY url_domains, referer_domains, date ORDER BY date ASC";
$this->load();
$this->load($link);
}

function load()
function load($link)
{
$result = mysql_query($this->load_query) or die ("Echec de la requête : ".$this->load_query." ". mysql_error());
$query = $link->prepare($this->load_query);
$query->execute();
$result = $query->get_result();
$i = 0;
while ($line = mysql_fetch_assoc($result))
while ($line = $result->fetch_assoc())
{
if ($line["url_domains"] != "")
{
Expand Down

3 comments on commit 4978326

@LaboCNIL
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, will change that in the next version. Thanks again for your help.

@pomeh
Copy link

@pomeh pomeh commented on 4978326 Nov 4, 2014

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@LaboCNIL for information, all reproductions steps are available on this page http://seclists.org/fulldisclosure/2014/Nov/3. Also, you can have a look to a tool named "The mole" which can scan the website for SQL injections vulnerabilities (see http://themole.sourceforge.net/?q=tutorial). Of course, this tool should only be used on a website you own and is not intended to attack someone else website.

@LaboCNIL
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes i try to reproduce from information describe in sec list.org. With the last patch, those bug seems to be fixed!

Please sign in to comment.