[31105] in bugtraq
Re: bug in Invision Power Board
daemon@ATHENA.MIT.EDU (Boy Bear)
Mon Aug 11 13:42:44 2003
Date: 9 Aug 2003 21:32:10 -0000
Message-ID: <20030809213210.15792.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: Boy Bear <eyal067@walla.co.il>
To: bugtraq@securityfocus.com
In-Reply-To: <20030809082131.25004.qmail@www.securityfocus.com>
To repair Bug to edit the file admin.php and to add after the line:
$IN['AD_SESS'] = $HTTP_POST_VARS['adsess'] ? $HTTP_POST_VARS['adsess'] :
$HTTP_GET_VARS['adsess'];
To add this :
if (isset($IN['AD_SESS'])) {
$IN['AD_SESS'] = htmlspecialchars($IN['AD_SESS']);
}
