must read for server ops: vulnerability in charmover

[Shin Noir]

mysql_query() sends a unique query (multiple queries are not supported) to the currently active database on the server that's associated with the specified link_identifier .

Are they using mysql_query()? If so, what's the problem again? Your "blahblahblah'; DROP ALL TABLES;--" example is two queries?

[KLS]

Is this stuff we really want to discuss in an open forum?

Yes, pretty much all vulnerabilities should be public. That way we:

a) Fix them.
b) Learn from them.
c) Get server ops to update their code.

[MNWatchdog]

plus the people who would use this know how to do it already most likely.

[AndMetal]

Originally Posted by Shin Noir

Are they using mysql_query()? If so, what's the problem again? Your "blahblahblah'; DROP ALL TABLES;--" example is two queries?

The problem is that it's still susceptible to injection. Although you can't just drop the database since it's running through PHP, you can still look for other pieces of data. I don't think it would be appropriate to provide a step-by-step tutorial on how to do this (there are plenty of them on the Internet already), but the idea is you can verify information from the database that you wouldn't normally have access to (mainly passwords and account names).

[airtalking]

AndMetal is correct even with access to only 1 query there are still several things that can be abused