NPDS
Responsive
NPDS REvolution 16.8
1 visiteur(s) et 0 membre(s) en ligne.
Mercredi 22 avril 2026 à 18:42:10
Mercredi 22 avril 2026 à 18:42:10
Anciens articles
- Samedi, 06 juillet
- Au collège Emmanuel de MARTONNE de 1995 à 2024 : Peut-on travailler autrement avec le numérique ?
- Les Frigoristes passent en 16.4
- Lundi, 15 avril
- Un module N P D S dans la littérature !
- REvolution v.16.4
- Lundi, 06 novembre
- Toutes les belles aventures ont une fin, et, le 6 octobre 2023, nous fermons le portail de TÉC.
Index du forum »» Sécurité »» search.php - time based sql injection
Modérateur(s)
Poster une réponse dans le sujet
Aperçu des sujets :
developpeur
Posté : 25-01-2015 18:07
Ce post reprends en anglais le topic déjà discuté ici => http://www.npds.org/viewtopic.php?topic=26189&forum=12
La correction sera mise à disposition rapidement
La correction sera mise à disposition rapidement
developpeur
Posté : 25-01-2015 18:03
======================================
Reported By - Narendra Bhati
Email - bhati.contact@gmail.com
Security Analyst @ Suma Soft. Pvt. Ltd
======================================
It is a time based sql injection http request = which is taking a time to response which make me confirm that there is a sql injection
===============================================
File : search.php
The verification in search.php that a SQL query is able to execute the sql statement: 'benchmark' establish the potential vulnerability to a SQL injection.
It's brilliant and many thanks to Narendra Bhati (Security Analyst - IT Risk & Security Management Services chez Suma Soft) for this.
Correction:
- The first step to correct is to add the word 'benchmark' in url protect.php (modules/include).
=> add a line below the " delete ", instruction in the sql_injection section => " benchmark ", in order to disable the issue.
- The second step is made directly by the core of NPDS in the sanitation of the SQL flow.
Many thanks one more time to Narendra Bhati.
Reported By - Narendra Bhati
Email - bhati.contact@gmail.com
Security Analyst @ Suma Soft. Pvt. Ltd
======================================
It is a time based sql injection http request = which is taking a time to response which make me confirm that there is a sql injection
===============================================
File : search.php
The verification in search.php that a SQL query is able to execute the sql statement: 'benchmark' establish the potential vulnerability to a SQL injection.
It's brilliant and many thanks to Narendra Bhati (Security Analyst - IT Risk & Security Management Services chez Suma Soft) for this.
Correction:
- The first step to correct is to add the word 'benchmark' in url protect.php (modules/include).
=> add a line below the " delete ", instruction in the sql_injection section => " benchmark ", in order to disable the issue.
- The second step is made directly by the core of NPDS in the sanitation of the SQL flow.
Many thanks one more time to Narendra Bhati.