gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Issue phpmyadmin-security/267 SQL injection in Designer feature

Browse Source 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
This commit is contained in:
Madhura Jayaratne 2018-12-26 22:48:47 +11:00
parent e172aa7548
commit 469934cf7d
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libraries/classes/Database/Designer.php
View File

@ -200,7 +200,8 @@ class Designer
. Util::backquote($cfgRelation['db']) . '.'
. Util::backquote($cfgRelation['designer_settings'])
. ' WHERE ' . Util::backquote('username') . ' = "'
. $GLOBALS['cfg']['Server']['user'] . '";';
. $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['user'])
. '";';
$result = $GLOBALS['dbi']->fetchSingleRow($query);

4
libraries/classes/Database/Designer/Common.php
View File

@ -787,8 +787,8 @@ class Common
. Util::backquote($cfgDesigner['db'])
. "." . Util::backquote($cfgDesigner['table'])
. " (username, settings_data)"
. " VALUES('" . $cfgDesigner['user'] . "',"
. " '" . json_encode($save_data) . "');";
. " VALUES('" . $GLOBALS['dbi']->escapeString($cfgDesigner['user'])
. "', '" . json_encode($save_data) . "');";
$success = $this->relation->queryAsControlUser($query);
}