vulnerable resource to sql injection how to fix it

  • Resolved _natty_

    (@_natty_)


    8 years, 7 months ago

    Hi to all,
    my host is godaddy and i bought a security suite service called “sitelock” that advise me that a resource is vulnerable to sql blind injection
    details as follow:

    Using the GET HTTP method, SiteLock found that :

    + The following resources may be vulnerable to blind SQL injection :

    + The ‘load%5B%5D’ parameter of the /wp-admin/load-styles.php CGI :

    /wp-admin/load-styles.php?c=0&ver=4.5&dir=ltr&load%5B%5D=dashicons%2cbut
    tons%2cforms%2cl10n%2cloginzz0&ver=4.5&dir=ltr&load%5B%5D=dashicons%2cbu
    ttons%2cforms%2cl10n%2cloginyy

    ——– output ——–
    #pass-strength-result,input,textarea{-webkit-box-sizing:border-box […]
    .locale-he-il em,.locale-zh-cn #local-time,.locale-zh-cn #utc-time […]
    #pass-strength-result,input,textarea{-webkit-box-sizing:border-box;-moz-
    box-sizing:border-box}.meta-box-sortables select,p.submit{max-width:100%
    }#your-profile label+a,.wp-admin select,fieldset label,label{vertical-al
    ign:middle}#pressthis-code-wrap,textarea{overflow:auto}input,texta […]

    ——– vs ——–
    #pass-strength-result,input,textarea{-webkit-box-sizing:border-box […]
    .locale-he-il em,.locale-zh-cn #local-time,.locale-zh-cn #utc-time […]
    ————————

    + The ‘rememberme’ parameter of the /wp-login.php CGI :

    /wp-login.php?pwd=&wp-submit=Login&testcookie=1&redirect_to=http%3a%2f%2
    fMYDOMAIN.COM%2fwp-admin%2f&reauth=1&Submit=Invio&action=postpass&log=&post_
    password=&rememberme=forever+or+1=0

    ——– output ——–
    HTTP/1.1 200 OK
    ——– vs ——–
    ————————

    I checked around for some solution, but the only advise that i find is to escape all the inputs or sanitize, or even make the queries in prefetch mode… ok I know what we talking about but how can I apply a solution like this to this problem? any other suggestion is wellcome…

Viewing 2 replies - 1 through 2 (of 2 total)

  • As the message says, it “may be vulnerable”. But it is not. I guess that the SiteLock scan found the word “load” in the URI and though it might be used in a SQL query. But that is not the case for this script. It only loads CSS files. So it should be safe to ignore the warning.

    Thread Starter _natty_

    (@_natty_)

    thanks for the tip

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘vulnerable resource to sql injection how to fix it’ is closed to new replies.