SQL-injection :(

9 Posts

Dionysius Reply #1, 16 years, 6 months ago

I type under authorized web-user

http://<mydomain.ru>/index.php?id=1’

and get the such error:

« MODx Parse Error »
MODx encountered the following error while attempting to parse the requested resource:
« Execution of a query to the database failed - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ’’, ’127.0.0.1’)’ at line 1 »
SQL: REPLACE INTO `modx`.`modx_active_users` (internalKey, username, lasthit, action, id, ip) values(-1, ’test_user’, ’1267636014’, ’998’, 1’, ’127.0.0.1’)
[Copy SQL to ClipBoard]

It should be something like this in php-code:

$id = intval($_GET['id'])

MODX Staff
730 Posts

netProphET Reply #2, 16 years, 6 months ago

In case anyone is chasing this down, it looks to me like lines 155-170 in manager/includes/accesscontrol.inc.php are where this happens.
Unfortunately I can’t go any further with it at the moment.

Mike Schell
Lead Developer, MODX Cloud
Email: [email protected]
GitHub: https://github.com/netProphET/
Twitter: @mkschell

9 Posts

Dionysius Reply #3, 16 years, 6 months ago

The bug is in assets/snippets/weblogin/weblogin.inc.php lines 106-109:

    $itemid = isset($_REQUEST['id']) ? $_REQUEST['id'] : 'NULL' ;$lasthittime = time();$a = 998;
    
    if($a!=1) {
        $sql = "REPLACE INTO $dbase.`".$table_prefix."active_users` (internalKey, username, lasthit, action, id, ip) values(-".$_SESSION['webInternalKey'].", '".$_SESSION['webShortname']."', '".$lasthittime."', '".$a."', ".$itemid.", '$ip')";