By Ken on Friday, 07 November 2014
Posted in General Issues
Replies 3
Likes 0
Views 877
Votes 0
Hi there, just want to report a possible SQL injection. Kindly check the report.
Hi,

Thanks for this. It looks like the report is localised to comments checking that is going on in the background. I will get this patched for the next version.
·
Friday, 07 November 2014 16:35
·
0 Likes
·
0 Votes
·
0 Comments
·
Hi jason, if possible, kindly include the patch in this thread too since this is pretty serious

I tried going to the page and it shows some part of my SQL which is quite serious


<title>1064 - You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '-19, 20' at line 1 SQL=SELECT `a`.* FROM `um6yn_social_comments` AS `a` WHERE `a`.`stream_id` = '15326' AND `a`.`element` = 'photos.user.upload' AND `a`.`uid` = '2336' AND `a`.`id` >= '1431' AND `a`.`parent` = '0' ORDER BY `created` asc LIMIT -19, 20</title>


Thanks!
Ken
·
Friday, 07 November 2014 16:52
·
0 Likes
·
0 Votes
·
0 Comments
·
Hi,

Please try replacing the file I've uploaded at /components/com_easysocial/controllers/comments.php
·
Friday, 07 November 2014 17:02
·
0 Likes
·
0 Votes
·
0 Comments
·
View Full Post