Skip to content

Commit

Permalink
Fixed Security issues regarding SQL Injection under special circumsta…
Browse files Browse the repository at this point in the history 
…nces.

This was only possible for logged in users.
This was reported @ http://www.exploit-db.com/exploits/24269/
  • Loading branch information
@Cyclodex
Cyclodex committed Jan 29, 2013
1 parent 906d00c commit d01d989
Show file tree
Hide file tree
Showing 3 changed files with 26 additions and 24 deletions.
29 changes: 15 additions & 14 deletions detail.php
View file
Expand Up @@ -45,9 +45,10 @@
if ( empty($_GET["id"]) ){
NConf_DEBUG::set("No id", 'ERROR');
}else{
$item_id = $_GET["id"];
$item_class = db_templates("class_name", $_GET["id"]);
$item_name = db_templates("naming_attr", $_GET["id"]);
// Be sure ID it is an integer - fixes injecting issues
$item_id = (int) $_GET["id"];
$item_class = db_templates("class_name", $item_id);
$item_name = db_templates("naming_attr", $item_id);
}
// end / exit page if error
if ( NConf_DEBUG::status('ERROR') ) {
Expand Down Expand Up @@ -76,17 +77,17 @@
$output = '';

// Edit
$output .= ( !isset($_GET["xmode"]) ) ? '<a href="handle_item.php?item='.$item_class.'&amp;id='.$_GET["id"].'">'.ICON_EDIT.'</a>' : '';
$output .= ( !isset($_GET["xmode"]) ) ? '<a href="handle_item.php?item='.$item_class.'&amp;id='.$item_id.'">'.ICON_EDIT.'</a>' : '';
// Clone
$output .= ( $item_class == "host" ) ? '<a href="clone_host.php?class='.$item_class.'&amp;id='.$_GET["id"].'">'.ICON_CLONE.'</a>' : '';
$output .= ( $item_class == "host" ) ? '<a href="clone_host.php?class='.$item_class.'&amp;id='.$item_id.'">'.ICON_CLONE.'</a>' : '';
// Delete
$output .= ( !isset($_GET["xmode"]) ) ? '<a href="delete_item.php?item='.$item_class.'&amp;ids='.$_GET["id"].'&amp;from='.$from_url.'">'.ICON_DELETE.'</a>' : '';
$output .= ( !isset($_GET["xmode"]) ) ? '<a href="delete_item.php?item='.$item_class.'&amp;ids='.$item_id.'&amp;from='.$from_url.'">'.ICON_DELETE.'</a>' : '';
// Services
$output .= ( $item_class == "host" ) ? '<a href="modify_item_service.php?id='.$_GET["id"].'">'.ICON_SERVICES.'</a>' : '';
$output .= ( $item_class == "host" ) ? '<a href="modify_item_service.php?id='.$item_id.'">'.ICON_SERVICES.'</a>' : '';
// History
$output .= '<a href="history.php?item='.$item_class.'&amp;id='.$_GET["id"].'&amp;from='.$from_url.'">'.ICON_HISTORY.'</a>';
$output .= '<a href="history.php?item='.$item_class.'&amp;id='.$item_id.'&amp;from='.$from_url.'">'.ICON_HISTORY.'</a>';
// Parent child
$output .= ( $item_class == "host" ) ? '<a href="dependency.php?id='.$_GET["id"].'">'.ICON_PARENT_CHILD.'</a>' : '';
$output .= ( $item_class == "host" ) ? '<a href="dependency.php?id='.$item_id.'">'.ICON_PARENT_CHILD.'</a>' : '';

echo $output;

Expand All @@ -112,7 +113,7 @@
WHERE id_attr=fk_id_attr
AND id_item=fk_id_item
AND ConfigAttrs.visible="yes"
AND id_item='.$_GET["id"].'
AND id_item='.$item_id.'
ORDER BY ConfigAttrs.ordering';

$result = db_handler($query, "array", "get basic entries");
Expand Down Expand Up @@ -145,7 +146,7 @@
AND ConfigAttrs.visible="yes"
AND fk_id_class=id_class
AND (SELECT naming_attr FROM ConfigAttrs WHERE id_attr=ConfigValues.fk_id_attr)="yes"
AND ItemLinks.fk_id_item='.$_GET["id"].'
AND ItemLinks.fk_id_item='.$item_id.'
ORDER BY
ConfigAttrs.friendly_name DESC,
ItemLinks.cust_order,
Expand All @@ -156,7 +157,7 @@


# get entries
$result = db_templates("linked_as_child", $_GET["id"], '', '', 'array');
$result = db_templates("linked_as_child", $item_id, '', '', 'array');
echo table_output($result, $item_class, "Child items linked");


Expand Down Expand Up @@ -291,11 +292,11 @@
if we want to change that, we have to get all normal types, and then group the child or bidirectionals as follows:
# get entries linked as child
$result = db_templates("linked_as_child", $_GET["id"], "link_as_child");
$result = db_templates("linked_as_child", $item_id, "link_as_child");
table_output($result, $item_class, "Child items linked");
# get bidirectional entries
$result = db_templates("linked_as_child", $_GET["id"], "link_bidirectional");
$result = db_templates("linked_as_child", $item_id, "link_bidirectional");
table_output($result, $item_class, "Bidirectional items");
*/
Expand Down
11 changes: 6 additions & 5 deletions detail_admin_items.php
View file
Expand Up @@ -5,7 +5,8 @@

# Get ID
if ( !empty($_REQUEST["id"]) ){
$id = $_REQUEST["id"];
// Be sure ID it is an integer - fixes injecting issues
$id = (int) $_REQUEST["id"];
}else{
NConf_DEBUG::set("No id", 'ERROR');
}
Expand Down Expand Up @@ -125,11 +126,11 @@

if(!isset($_GET["xmode"])){
if ($type == "attr"){
echo '<a href="modify_attr.php?id='.$_GET["id"].'">'.ICON_EDIT.'</a>';
echo '<a href="delete_attr.php?id='.$_GET["id"].'">'.ICON_DELETE.'</a>';
echo '<a href="modify_attr.php?id='.$id.'">'.ICON_EDIT.'</a>';
echo '<a href="delete_attr.php?id='.$id.'">'.ICON_DELETE.'</a>';
}elseif($type == "class"){
echo '<a href="modify_class.php?id='.$_GET["id"].'">'.ICON_EDIT.'</a>';
echo '<a href="delete_class.php?id='.$_GET["id"].'">'.ICON_DELETE.'</a>';
echo '<a href="modify_class.php?id='.$id.'">'.ICON_EDIT.'</a>';
echo '<a href="delete_class.php?id='.$id.'">'.ICON_DELETE.'</a>';
}
}
echo '</div>';
Expand Down
10 changes: 5 additions & 5 deletions include/tabs/history.php
View file
Expand Up @@ -30,10 +30,10 @@
echo '<div>';


if ( !empty($_GET["id"]) ){
if ( !empty($item_id) ){
# Normal query
$query = 'SELECT timestamp, action, attr_name FROM History
WHERE fk_id_item='.$_GET["id"].'
WHERE fk_id_item='.$item_id.'
AND action <> "edited"
ORDER BY timestamp DESC, id_hist DESC
LIMIT '.HISTORY_TAB_LIMIT.';';
Expand All @@ -52,7 +52,7 @@
<td colspan=2>Last '.HISTORY_TAB_LIMIT.' changes:</td>
<td>
<div align="right">
<a href="history.php?id='.$_GET["id"].'">show all changes</a>
<a href="history.php?id='.$item_id.'">show all changes</a>
</div>
</td>
</tr>';
Expand Down Expand Up @@ -84,8 +84,8 @@
echo '<td>'.$timestamp.'</td>';
echo '<td>'.$entry["action"].'</td>';
echo '<td>';
if ( !empty($_GET["id"]) ){
echo '&nbsp<a href="history.php?id='.$_GET["id"].'&amp;filter='.$entry["attr_name"].'">'.$entry["attr_name"].'</a>';
if ( !empty($item_id) ){
echo '&nbsp<a href="history.php?id='.$item_id.'&amp;filter='.$entry["attr_name"].'">'.$entry["attr_name"].'</a>';
}else{
echo $entry["attr_name"];
}
Expand Down

0 comments on commit d01d989

Please sign in to comment.