Menu
▾
▴
Re: [WebERP-developers] Fwd: Aw: Vulnerabilities in webERP
|
From: Phil D. <ph...@lo...> - 2020-07-25 05:53:34
|
There is $_GET sanitation in includes/session.php but using this syntax to send the parameter containing the script defeats our sanitation sadly 😢 Phil Phil Daintree +64 (0)275 567 890 > On 23/07/2020, at 12:33 PM, Exson Qu <hex...@gm...> wrote: > > Dear all, > I checked these cases yesterday. and following is the summary: > 1. GET x-site attack cannot be sanitized by current code > because there is no $_GET set up. We should enhance the code to parse the > uri. > 2. The POST injection is a little special since there is no Var > validation in the script mentioned-- GLCashFlowsIndirect.php. It is > easy to fix by adding validation. > > We feedback more as I find a solution for x-site attack. > Best regards! > Exson > > > >> On Wed, Jul 22, 2020 at 9:39 AM Phil Daintree <ph...@lo...> wrote: >> >> Gents, >> >> This looks like it is sent as GET parameter but is not captured by our >> session cleansing routine? >> >> Anyone any ideas? >> >> Phil >> -------- Forwarded Message -------- >> Subject: Aw: Vulnerabilities in webERP >> Date: Sat, 18 Jul 2020 10:51:14 +0200 >> From: Mario Riederer <Mar...@gm...> >> To: Phil Daintree <ph...@lo...> >> >> >> >> Hello Phil, >> thanks for your reply :) >> I found 2 Cross Site Scripting and 2 SQL Injections in the software. >> You can find an explanation of the vulnerabilities in the Attachment. >> Please let me know if you need further help. >> Best regards, >> Mario >> *Gesendet:* Samstag, 18. Juli 2020 um 07:22 Uhr >> *Von:* "Phil Daintree" <ph...@lo...> >> *An:* mar...@gm..., "in...@we..." <in...@we...> >> *Betreff:* Vulnerabilities in webERP >> Hi Mario, >> >> Further to your message to me at Logic Works ... if you could expand on >> the vulnerabilities please so we can fix. >> >> Many thanks >> >> Phil >> >> -- >> Phil Daintree >> 0275 567890 >> _______________________________________________ >> Web-erp-developers mailing list >> Web...@li... >> https://lists.sourceforge.net/lists/listinfo/web-erp-developers >> > > _______________________________________________ > Web-erp-developers mailing list > Web...@li... > https://lists.sourceforge.net/lists/listinfo/web-erp-developers |
