.mario
03/04/07, 23:29
There's a problem in the current serendipity version (1.1.2). Via URL
manipulation you can get the system to halt and throw out a SQL error
message including the whole query.
Issue: Information disclosure
Impact: low
PoC: http://blog.s9y.org/archives/2007/04/C0.html
Status: reported
Bug: http://sourceforge.net/tracker/index.php?func=detail&atid=542822&aid=1691993&group_id=75065
Also weird but not really related is this issue:
http://blog.s9y.org/archive/2007/04/C0.html
Not much blogging in the late seventies...
Greetings,
..mario
manipulation you can get the system to halt and throw out a SQL error
message including the whole query.
Issue: Information disclosure
Impact: low
PoC: http://blog.s9y.org/archives/2007/04/C0.html
Status: reported
Bug: http://sourceforge.net/tracker/index.php?func=detail&atid=542822&aid=1691993&group_id=75065
Also weird but not really related is this issue:
http://blog.s9y.org/archive/2007/04/C0.html
Not much blogging in the late seventies...
Greetings,
..mario