SQL Injection vulnerability #1

New issue

Closed

opened 2020-10-01 14:59:30 +08:00 by dseller · 2 comments

dseller commented

2020-10-01 14:59:30 +08:00

(Migrated from github.com)

Hi,

I came across your project on the selfhosted subreddit, decided to look at your code. One thing that immediately struck my eye was a SQL injection vunerability in article.php, as linked here:

github.com/MatthK/Selfoss-Webfront@a66df218b7/website/article.php (L17)

I haven't checked the rest of the files, but in my experience if you have one SQL injection vulnerability, then there's probably more.

You can use parameters instead of string concatenation to make it secure.

Kind regards,
Dennis

Hi, I came across your project on the `selfhosted` subreddit, decided to look at your code. One thing that immediately struck my eye was a SQL injection vunerability in `article.php`, as linked here: https://github.com/MatthK/Selfoss-Webfront/blob/a66df218b70f9d8bc91aa44904c2f76b91c264c4/website/article.php#L17 I haven't checked the rest of the files, but in my experience if you have one SQL injection vulnerability, then there's probably more. You can use parameters instead of string concatenation to make it secure. Kind regards, Dennis

MatthK commented

2020-10-01 17:33:46 +08:00

(Migrated from github.com)

Yes, I am aware of that. The thing was created with the idea of having it behind a firewall installed for personal use, so the risk there should be limited. I might adjust that and also correct the other 2 potential cases.

MatthK commented

2020-10-01 21:08:15 +08:00

(Migrated from github.com)