SQL INJECTION vulnerability fixed in revision 1661

by **PleegWat** » Wed Feb 13, 2008 11:40 pm

I just discovered a SQL injection vulnerability in all roster 2.0 beta revisions. This has been fixed in SVN revision 1661. This vulnerability affects you if:

- Your host supports .htaccess files and mod_rewrite
- Your host has magic_quotes_gpc turned OFF in php.ini

To fix this issue, do one of the following:

- Update to SVN revision 1661 (recommended)
- Turn mod_rewrite off in php.ini
- Turn magic_quotes_gpc on in php.ini
- delete the .htaccess file in your roster root (this file is invisible by default)

by **MattM** » Thu Feb 14, 2008 8:28 am

Please make sure to upgrade your testbeds.

by **PleegWat** » Thu Feb 28, 2008 2:33 am

Bump for unsticky. More than two weeks since it popped up now.