Welcome, Guest! Log In | Create Account
Programming Languages: PHP
License: GNU General Public License (GPL)
CVS browse code, statistics cvs -d:pserver:anonymous@phpweblog.cvs.sourceforge.net:/cvsroot/phpweblog login cvs -z3 -d:pserver:anonymous@phpweblog.cvs.sourceforge.net:/cvsroot/phpweblog co -P modulename
cvs -d:pserver:anonymous@phpweblog.cvs.sourceforge.net:/cvsroot/phpweblog login cvs -z3 -d:pserver:anonymous@phpweblog.cvs.sourceforge.net:/cvsroot/phpweblog co -P modulename
THE BUG WAS FOUND IN: func.inc.php function F_loginUser($Username,$Password) { global $db; $sql = "UPDATE T_Users SET "; $sql .= "LastLogin = now() "; $sql .= "WHERE Username = '$Username' "; $sql .= "AND Password = '" . md5($Password) . "' "; $sql .= "AND Verified = 'Y'"; mysql_query($sql,$db); if (mysql_affected_rows()>0) { return true; The input is not sanitized.
2009-10-30 18:30:58 UTC by tavezbadalov
Copyright © 2010 Geeknet, Inc. All rights reserved. Terms of Use
