webSPELL 4.2.0d (Linux) - Local File Disclosure

/ webSPELL ------------------------------ Possible Fix: $file = pregreplace'/^a-zA-Z0-9/','',addslashes$GET'id'; otherwise if $GET'id' variable is an integer use intval function. $file =...

writersblock-sql.txt

Writer’s Block SQL Injection Vulnerabilities ".$GET'PostID'." AND Draft=0 ORDER BY Timestamp ASC LIMIT 1"; ---- x Exploit The issue can be exploited through a web browser. x Patch Just add an intval: ---- permalink.php, line 212: $getpost = @mysqlquery"SELECT Title, Timestamp, Body, PostCat1,...