phpSlash "story_id" Parameter Remote SQL Injection Vulnerability

hi everyone

I just caught this in my rss feed :

http://pridels.blogspot.com/2005/12/phpslash-sql-vuln.html
http://www.frsirt.com/english/advisories/2005/3044

dunno what the exploit looks like, but I immediately made this
modification to my file Story.class

    function getStory($story_id, $mode, $argv_ary="", $tpl="") {
[+]      $story_id = @(int) $story_id;


be well

tobozo




-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click