[41579] in bugtraq
Re: [KAPDA::#16] - SMF SQL Injection
daemon@ATHENA.MIT.EDU (grudge@securityfocus.com,simplemac)
Sat Dec 10 12:41:41 2005
Date: 10 Dec 2005 11:51:26 -0000
Message-ID: <20051210115126.18697.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: grudge@securityfocus.com, simplemachines@securityfocus.com,
org@securityfocus.com
To: bugtraq@securityfocus.com
I'm a developer from over at simplemachines and I do not see how this can pose an exploit? Let's examine the code piece by piece:
The code is entered at this point:
if (!is_numeric($_REQUEST['start']))
So, will be executed if $_REQUEST['start'] is a string. It's then used in the query. However, it's used in the query in this piece of code:
substr(strtolower($_REQUEST['start']), 0, 1)
So, the string is set to lower case, and then only the FIRST letter is used within the query. How can anyone exploit the database with a one character insertion? Of course this is within single quotes as well, so it cannot even be a command.
I simply cannot see how you could possibly exploit SQL from this?
