Security Issues

[Zepo.]

We've been having problems with the database getting played around with.

So can someone go through for security holes please, ftb2.elitebattles.com/standings.php

 

Thanks so much

-Zepo.

[agentsteal]

Cross Site Scripting:

http://ftb2.elitebattles.com/cgi-sys/scgiwrap/<marquee><h1>vulnerable</marquee>

 

Cross Site Scripting:

http://ftb2.elitebattles.com/manager.php?login[id]='<marquee><h1>vulnerable</marquee>

 

Cross Site Scripting:

http://ftb2.elitebattles.com/report.php?login[id]='<marquee><h1>vulnerable</marquee>

 

Full Path Disclosure:

http://ftb2.elitebattles.com/cgi-sys/scgiwrap/

 

SQL Error:

http://ftb2.elitebattles.com/standings.php?ladder[id]=9&ladder[rank]='

 

User Enumeration:

http://ftb2.elitebattles.com/~burly

[kenrbnsn]

To protect links from the forum software, either put them in

blocks or surround them with [nobbc][/nobbc] tags.

 

Ken

[kathas]

for the problem caused in agantsteal's last post...

 

You haven't put the number in single quotes in your sql query.

 

It looks like this

`rank` = (number)

while it should look like this

`rank` = '(number)'

or you could force the (number) to be really a number

<?php
$number = (int)$_GET['rank']; //this returns 0 when not a numeric value is assigned
?>

 

 

[Zepo.]

Im guessing then it would be somewhere in here:

if(!$ladder[rank]){
$ladder[rank]="1";
}
$ladder[rank]=($ladder[rank] - 1);
if ($ladder[unranked]){
$rcount="-";
}else{
$rcount="$ladder[rank]"; }


if($ladder[unranked]){
$whereranked="WHERE rank < 1";
$rankswitch="Showing Unranked $teamsword :: <a href='$config[scripturl]/standings.php?ladder[id]=$ladder[id]&ladder[unranked]=0'><font face='verdana' size='-2' color='#FFFFFF'>[Ranked]</a>";
}else{
$whereranked="WHERE rank > 0";
$rankswitch="Showing Ranked $teamsword :: <a href='$config[scripturl]/standings.php?ladder[id]=$ladder[id]&ladder[unranked]=1'><font face='verdana' size='-2' color='#FFFFFF'>[unranked]</a>";
}