must read for server ops: vulnerability in charmover

[AndMetal]

Originally Posted by airtalking

I guess i could explain further... say you got

$name = $_POST['name'];
$sql = "SELECT * FROM table WHERE name = '$name';

if a user submits his name as (forgive my syntax on droping i know its wrong)

blahblahblah'; DROP ALL TABLES;--

then when it gets plugged into $sql you would get

SELECT * FROM table WHERE name = 'blahblahblah'; DROP ALL TABLES;--'

the -- at the end would comment out the trailing quote. If magic quotes is on, or you use the code in the first post it will add a / before any quote or /. So with magic quotes on you would get

SELECT * FROM table WHERE name = 'blahblahblah/'; DROP ALL TABLES;--'

That would cause an error and none of the sql gets executes saving your database.

Fortunately, PHP5 (and possibly PHP4, I can't remember where I read it to verify) doesn't allow multiple queries in 1 execution. Otherwise, any server running the older version of the Allakhazam Clone would be screwed (pretty much all of the search fields are susceptible to injection), allowing someone to give themselves equip, instant max level, max pp, etc.

However, you could attempt to discover an admin password from the account table using subqueries & a bit of trial an error.

As for a fix, I don't know that I'd recommend just depending on escaping quotes, but rather validating the actual submitted value. Specifically, since we're just looking at a name, there shouldn't be any spaces, special characters, numbers, etc. So, we could do a simple Regular Expression:

[A-Za-z]+

[airtalking]

correct me if i'm wrong... but php just passes the string to mysql and it decides what to do with it... why would php validate database input, and I aggree the alla clone is a mess for validation.

What i've been doing in the mag clone is only allowing alpha characters in there using a php function, similar to your regex. That was the same plan I had for character name... as for username I wouldn't mind getting a list of available characters from the devs here.

[airtalking]

yea, from php.net

mysql_query() sends a unique query (multiple queries are not supported) to the currently active database on the server that's associated with the specified link_identifier .

the ease of trying to force out a password would be alot easier since the database format is open source.

[trevius]

Is this stuff we really want to discuss in an open forum?