MySQL injection? about gamepanelx-v3 HOT 8 CLOSED

Wow, what the hell. Thank you for reporting. Looking into this now.

from gamepanelx-v3.

Patched. Thank you so much for reporting this. I have no idea where my mind was when I wrote this code. Probably focused too much on salting/base64'ing and didn't notice I failed to fix SQLi. Argh! Commit is here:

bab5ff5

from gamepanelx-v3.

Thanks, it's an easy fix with the login form, which probably keeps most of the people with bad intentions out. The problem is it also works with some other forms like the server description...

from gamepanelx-v3.

Thanks man :)

from gamepanelx-v3.

Re-opening this. If you find SQLi issues on any other forms, can you post them here? I am usually very serious and look at every input that I can to fix SQL injection. I am human however and it's possible one is missing, though I seriously hope not.

Note that I removed your GIF image only to not help people exploit the issue more than it needs to be :)

from gamepanelx-v3.

No worries, thanks for providing an awesome panel for free. I feel bad for letting you know now, haha. What's the easiest way to contact you anyways?

I think the problem might be that the base64 encoded strings can't be escaped by mysql_real_escape in ajax.php, so it passes straight through. For example in /scripts/internal/network.js, line 98 and 190 some encoded strings are sent to ajax.php.

from gamepanelx-v3.

Don't feel bad, that's the whole point of it being open source. I'm glad you caught it. On here is the easiest way to contact/report issues as it goes straight to my email and is public.

You might be right about the base64 stuff as there are only a few javascript functions that use the base64 library. I will check that out tomorrow, but it sounds like a good lead.

from gamepanelx-v3.

Note that the recent commit fixed SQLi on the login forms in a better way, fixes SQLi on the network actions page, and the API SQLi is now patched.

8113841

from gamepanelx-v3.