|
Written by Matt Zundel
|
|
Friday, 31 December 2010 07:50 |
|
I discovered there were two problems with the Swap Meet section on the site. The first was just some wording and the other was a potentially dangerous item.
Postal Code The component was developed by an individual in the UK. One item of carry over was the Postal Code -- He had it setup to accept UK postal codes only. While I removed the code that restricted postal codes for the UK, I failed to remove the wording. This wording has been removed and replaced with our standard postal code format: XXXXX or XXXXX-XXXX.
SQL Injection There was a potential for an SQL injection on the site through the swap meet component. I have added some extra code to parse any input from the browser to prevent SQL injection. With a successful SQL injection, a malicious individual could read/write/delete any part of the database. This was a good hole to have plugged.
|
|
Last Updated on Friday, 31 December 2010 08:21 |