Evaders99
Joined: Jan 11, 2002
Posts: 3049
Location: USA
|
 Posted: Fri Jun 01, 2007 7:08 pm Post subject: Security: NukeSentinel <= 2.5.06 (mysql >= 4.0.24) Rem |
 |
|
This deals specifically with NukeSentinel... see this thread for suggested changes as well:
http://evaders.swrebellion.com/forums/postp366.html#366
While this topic indicates that 2.5.06 and lower is fine, I don't believe it is. All versions so far (including 2.5.09) are vulnerable.
| Code: |
in includes/nukesentinel.php
FIND
$db->sql_query("INSERT INTO `".$prefix."_nsnst_tracked_ips` (`user_id`, `username`, `date`, `ip_addr`, `ip_long`, `page`, `user_agent`, `refered_from`, `x_forward_for`, `client_ip`, `remote_addr`, `remote_port`, `request_method`, `c2c`) VALUES ('".$nsnst_const['ban_user_id']."', '$ban_username2', '".$nsnst_const['ban_time']."', '".$nsnst_const['remote_ip']."', '".$nsnst_const['remote_long']."', '$pg', '$user_agent', '$refered_from', '".$nsnst_const['forward_ip']."', '".$nsnst_const['client_ip']."', '".$nsnst_const['remote_addr']."', '".$nsnst_const['remote_port']."', '".$nsnst_const['request_method']."', '$c2c')");
CHANGE TO
$db->sql_query("INSERT INTO `".$prefix."_nsnst_tracked_ips` (`user_id`, `username`, `date`, `ip_addr`, `ip_long`, `page`, `user_agent`, `refered_from`, `x_forward_for`, `client_ip`, `remote_addr`, `remote_port`, `request_method`, `c2c`) VALUES ('".addslashes($nsnst_const['ban_user_id'])."', '$ban_username2', '".addslashes($nsnst_const['ban_time'])."', '".addslashes($nsnst_const['remote_ip'])."', '".addslashes($nsnst_const['remote_long'])."', '$pg', '$user_agent', '$refered_from', '".addslashes($nsnst_const['forward_ip'])."', '".addslashes($nsnst_const['client_ip'])."', '".addslashes($nsnst_const['remote_addr'])."', '".addslashes($nsnst_const['remote_port'])."', '".addslashes($nsnst_const['request_method'])."', '$c2c')");
FIND
$db->sql_query("INSERT INTO `".$prefix."_nsnst_blocked_ips` VALUES ('$banip', '$banlong', '".$nsnst_const['ban_user_id']."', '$ban_username', '$user_agent', '".$nsnst_const['ban_time']."', '$addby', '".$blocker_row['blocker']."', '$querystring', '$getstring', '$poststring', '".$nsnst_const['forward_ip']."', '".$nsnst_const['client_ip']."', '".$nsnst_const['remote_addr']."', '".$nsnst_const['remote_port']."', '".$nsnst_const['request_method']."', '$abexpires', '$c2c')");
CHANGE TO
$db->sql_query("INSERT INTO `".$prefix."_nsnst_blocked_ips` VALUES ('".addslashes($banip)."', '$banlong', '".addslashes($nsnst_const['ban_user_id'])."', '$ban_username', '$user_agent', '".addslashes($nsnst_const['ban_time'])."', '$addby', '".addslashes($blocker_row['blocker'])."', '".addslashes($querystring)."', '".addslashes($getstring)."', '".addslashes($poststring)."', '".addslashes($nsnst_const['forward_ip'])."', '".addslashes($nsnst_const['client_ip'])."', '".addslashes($nsnst_const['remote_addr'])."', '".addslashes($nsnst_const['remote_port'])."', '".addslashes($nsnst_const['request_method'])."', '".addslashes($abexpires)."', '$c2c')");
|
_________________
Evaders99
 Webmaster
 Administrator
Fighting is terrible, but not as terrible as losing the will to fight.
- SW:Rebellion Network - Evaders Squadron Coding -
The cake is a lie. |
|
![Welcome to Evaders Squadron Coding [ESC]](themes/Onset/images/logo.gif){kind=logo}
