sql injection in search_clause possible
fago - September 22, 2005 - 19:17
| Project: | Flexinode |
| Version: | 4.6.x-1.x-dev |
| Component: | Code |
| Category: | bug report |
| Priority: | critical |
| Assigned: | Unassigned |
| Status: | closed |
Jump to:
Description
the flexinode fields select and checkbox doesn't check the submitted values before inserting them in the sql clause, as an affect this allows sql injection in the clause.
patch attached
| Attachment | Size |
|---|---|
| flexinode_sql.patch | 1.48 KB |
#1
committed to cvs. Setting to active. Check if it applies to HEAD as well.
#2
chx has already commited a fix for head.
#3