היות וכולנו מכירים בכוחה של השקיפות לתקן ולשפר אז -
- קוד: בחר הכל
Hi...
I think jlc.org.il web site is a right thing to promote Linux
in Jerusalem and Israel.
But this website has a serious security issue.
You have SQL injections in all "GET" querys.
Example:
http://www.jlc.org.il/?page=lecturers/lecturer&id=100000000%20union%20all%20select%20null,@@version,char(39,85,95,72,97,118,101,95,83,81,76,95,73,110,106,99,116,105,111,110,39),null,null,null,null
In this example I use union operator to get version of SQL server, and
print 'U_Have_SQL_Injection' string on webpage...
Why this happen?
You don't filter GET query correctly. Your filter adds symbol "\" to
all special characters, but this is INSECURE! In my example I don`t use
any special characters, and I use char() function to get symbol "'".
Tip:
If you don`t use any characters except numbers in yours query (and u
not
use) - simple delete all characters except numbers. And always check
length of query. This is most simple and secure way.
