We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
MODX Community Forums Archive

Old Snippets(FlexSearchForm,UserComments) progrem

    • 28073
    • 164 Posts
    soushi Reply #1, 18 years, 6 months ago
    Dear all,

    Old Snippets(FlexSearchForm,UserComments) seems to include SQL injection problem.
    The expected problem is as follows.

    [FlexSearchForm]
    SQL sentence is executed many times, and a large amount of logs are output.

    [UserComments]
    Data can be changed.
    The following examples set "DATA" to "Introtext" column. 

    ',content) ,introtext = 'DATA' , description = CONCAT('a


    FlexSearchForm and UserComments is still used by the blog of MODx(http://modxcms.com/blog.html) and MODx site serarch(http://modxcms.com/).
    Is it safe?

    Sincerely yours,
      • 10487 MODX Staff
      • 1,535 Posts
      Garry Nutting Reply #2, 18 years, 6 months ago
      I’ve looked into this and the only way that these snippets could be used for SQL injection is if magic_quotes_gpc is set to ’off’. In the case of the MODx website, magic_quotes_gpc is set to ’on’ so there’s no possible exploit.

      However, it’s not good to rely on the magic_quotes_gpc setting as some PHP configurations may well have it turned off, so I’m looking at creating a patched version for each of these snippets that uses $modx->db->escape() for any values that are used in the queries (a guaranteed way of making sure that the values are correctly escaped)
        Garry Nutting
        Senior Developer
        MODX, LLC

        Email: [email protected]
        Twitter: @garryn
        Web: modx.com
        • 10487 MODX Staff
        • 1,535 Posts
        Garry Nutting Reply #3, 18 years, 6 months ago
        Okay, patched files attached - soushi, could you test the patches to see if it solves the SQL injection issue at your end?

        Thanks,
        Garry
          Garry Nutting
          Senior Developer
          MODX, LLC

          Email: [email protected]
          Twitter: @garryn
          Web: modx.com
          • 19033
          • 892 Posts
          MEGU Reply #4, 18 years, 5 months ago
          Dear garryn,

          Thank you for taking out a patch immediately.
          soushi be confirming them, and then he will answer to you.

          Sincerely yours,
          MEGU
            • 28073
            • 164 Posts
            soushi Reply #5, 18 years, 5 months ago
            Dear garryn,

            Thank you for corresponding.
            There were some problems when I tested this patch.

            [FlexSearchForm]
            When going from the result page to the next result page, slash is doubly added to the "search strings".
            I corrected it as follows.

            FlexSearchForm0-7.txt:about 335line
                $limit = $modx->recordCount($rs);
    $searchString = stripslashes($searchString); //<- add

    if($limit>0) {



            [UserComments]
            The escape doubly hangs to "pagetitle".
            I corrected it as follows.

            UserComments1-2.txt:about 210line
            		$doc = $modx->getDocument($docid);
		//$title = mysql_escape_string($doc['pagetitle']).' - User comments'; //comment out
		$title = $doc['pagetitle'].' - User comments';  //add
		$flds = array(


            also...

            Quote from: garryn at Mar 31, 2008, 03:21 PM

            I’ve looked into this and the only way that these snippets could be used for SQL injection is if magic_quotes_gpc is set to ’off’. In the case of the MODx website, magic_quotes_gpc is set to ’on’ so there’s no possible exploit.

            "magic_quotes_gpc" set to off in many cases in Japan.
            Because it causes the unintelligible sequence of multibyte characters. :’(

            Sincerely yours,
            soushi