Skip to content
This repository was archived by the owner on Mar 28, 2019. It is now read-only.

Commit 447a7a4

Browse files
ngsankhangsankha
committed
fixed sql injection vulnerability
1 parent dd6a4ab commit 447a7a4

File tree

7 files changed

+32
-47
lines changed

7 files changed

+32
-47
lines changed

‎admin/createadmin.php

Lines changed: 0 additions & 22 deletions
This file was deleted.

‎admin/preview.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,11 @@
88
echo("<hr/>\n<h1>".$_POST['title']."</h1>\n");
99
echo($out);
1010
}
11-
} else if($_POST['action'] == 'code') {
11+
} else if($_POST['action'] == 'code' and is_numeric($_POST['id'])) {
1212
include('../functions.php');
1313
connectdb();
1414
echo("<hr/><h1><small>".$_POST['name']."</small></h1>\n");
15-
$query = "SELECT filename, soln FROM solve WHERE (username='".$_POST['uname']."' AND problem_id='".$_POST['id']."')";
15+
$query = "SELECT filename, soln FROM solve WHERE (username='".mysql_real_escape_string($_POST['uname'])."' AND problem_id='".$_POST['id']."')";
1616
$result = mysql_query($query);
1717
$row = mysql_fetch_array($result);
1818
$str = str_replace("<", "&lt;", $row['soln']);

‎admin/update.php

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
connectdb();
44
if(isset($_POST['action'])){
55
if($_POST['action']=='email') {
6-
mysql_query("UPDATE users SET email='".$_POST['email']."' WHERE username='".$_SESSION['username']."'");
6+
mysql_query("UPDATE users SET email='".mysql_real_escape_string($_POST['email'])."' WHERE username='".$_SESSION['username']."'");
77
header("Location: index.php?changed=1");
88
} else if($_POST['action']=='password') {
99
$query = "SELECT salt,hash FROM users WHERE username='admin'";
@@ -23,29 +23,29 @@
2323
if($_POST['cpp']=='on') $cpp=1; else $cpp=0;
2424
if($_POST['java']=='on') $java=1; else $java=0;
2525
if($_POST['python']=='on') $python=1; else $python=0;
26-
mysql_query("UPDATE prefs SET name='".$_POST['name']."', accept=$accept, c=$c, cpp=$cpp, java=$java, python=$python");
26+
mysql_query("UPDATE prefs SET name='".mysql_real_escape_string($_POST['name'])."', accept=$accept, c=$c, cpp=$cpp, java=$java, python=$python");
2727
header("Location: index.php?changed=1");
2828
} else if($_POST['action']=='addproblem') {
29-
$query="INSERT INTO `problems` ( `name` , `text`, `input`, `output`) VALUES ('".$_POST['title']."', '".$_POST['problem']."', '".$_POST['input']."', '".$_POST['output']."')";
29+
$query="INSERT INTO `problems` ( `name` , `text`, `input`, `output`) VALUES ('".mysql_real_escape_string($_POST['title'])."', '".mysql_real_escape_string($_POST['problem'])."', '".mysql_real_escape_string($_POST['input'])."', '".mysql_real_escape_string($_POST['output'])."')";
3030
mysql_query($query);
3131
header("Location: problems.php?added=1");
32-
} else if($_POST['action']=='editproblem') {
33-
mysql_query("UPDATE problems SET input='".$_POST['input']."', output='".$_POST['output']."', name='".$_POST['title']."', text='".$_POST['problem']."' WHERE sl='".$_POST['id']."'");
32+
} else if($_POST['action']=='editproblem' and is_numeric($_POST['id'])) {
33+
mysql_query("UPDATE problems SET input='".mysql_real_escape_string($_POST['input'])."', output='".mysql_real_escape_string($_POST['output'])."', name='".mysql_real_escape_string($_POST['title'])."', text='".mysql_real_escape_string($_POST['problem'])."' WHERE sl='".$_POST['id']."'");
3434
mysql_query($query);
3535
header("Location: problems.php?updated=1&action=edit&id=".$_POST['id']);
3636
}
3737
}
3838
else if(isset($_GET['action'])){
39-
if($_GET['action']=='delete') {
39+
if($_GET['action']=='delete' and is_numeric($_GET['id'])) {
4040
$query="DELETE FROM problems WHERE sl=".$_GET['id'];
4141
mysql_query($query);
4242
header("Location: problems.php?deleted=1");
4343
} else if($_GET['action']=='ban') {
44-
$query="UPDATE users SET status=0 WHERE username='".$_GET['username']."'";
44+
$query="UPDATE users SET status=0 WHERE username='".mysql_real_escape_string($_GET['username'])."'";
4545
mysql_query($query);
4646
header("Location: users.php?banned=1");
4747
} else if($_GET['action']=='unban') {
48-
$query="UPDATE users SET status=1 WHERE username='".$_GET['username']."'";
48+
$query="UPDATE users SET status=1 WHERE username='".mysql_real_escape_string($_GET['username'])."'";
4949
mysql_query($query);
5050
header("Location: users.php?unbanned=1");
5151
}

‎eval.php

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,17 @@
88
$query = "SELECT status FROM users WHERE username='".$_SESSION['username']."'";
99
$result = mysql_query($query);
1010
$status = mysql_fetch_array($result);
11-
if($accept['accept'] == 1 and $status['status'] == 1) {
11+
if($accept['accept'] == 1 and $status['status'] == 1 and is_numeric($_POST['id'])) {
12+
$soln = mysql_real_escape_string($_POST['soln']);
13+
$filename = mysql_real_escape_string($_POST['filename']);
14+
$lang = mysql_real_escape_string($_POST['lang']);
1215
if($_POST['ctype']=='new')
13-
$query = "INSERT INTO `solve` ( `problem_id` , `username`, `soln`, `filename`, `lang`) VALUES ('".$_POST['id']."', '".$_SESSION['username']."', '".mysql_real_escape_string($_POST['soln'])."', '".mysql_real_escape_string($_POST['filename'])."', '".$_POST['lang']."')";
16+
$query = "INSERT INTO `solve` ( `problem_id` , `username`, `soln`, `filename`, `lang`) VALUES ('".$_POST['id']."', '".$_SESSION['username']."', '".$soln."', '".$filename."', '".$lang."')";
1417
else {
1518
$tmp = "SELECT attempts FROM solve WHERE (problem_id='".$_POST['id']."' AND username='".$_SESSION['username']."')";
1619
$result = mysql_query($tmp);
1720
$fields = mysql_fetch_array($result);
18-
$query = "UPDATE solve SET lang='".$_POST['lang']."', attempts='".($fields['attempts']+1)."', soln='".mysql_real_escape_string($_POST['soln'])."', filename='".mysql_real_escape_string($_POST['filename'])."' WHERE (username='".$_SESSION['username']."' AND problem_id='".$_POST['id']."')";
21+
$query = "UPDATE solve SET lang='".$lang."', attempts='".($fields['attempts']+1)."', soln='".$soln."', filename='".$filename."' WHERE (username='".$_SESSION['username']."' AND problem_id='".$_POST['id']."')";
1922
}
2023
mysql_query($query);
2124
$socket = fsockopen($compilerhost, $compilerport);
@@ -28,7 +31,7 @@
2831
$fields = mysql_fetch_array($result);
2932
$input = str_replace("\n", '$_n_$', treat($fields['input']));
3033
fwrite($socket, $input."\n");
31-
fwrite($socket, $_POST['lang']."\n");
34+
fwrite($socket, $lang."\n");
3235
$status = fgets($socket);
3336
$contents = "";
3437
while(!feof($socket))

‎login.php

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,27 +3,29 @@
33
if(loggedin())
44
header("Location: index.php");
55
else if(isset($_POST['action'])) {
6+
$username = mysql_real_escape_string($_POST['username']);
67
if($_POST['action']=='login') {
78
connectdb();
8-
$query = "SELECT salt,hash FROM users WHERE username='".$_POST['username']."'";
9+
$query = "SELECT salt,hash FROM users WHERE username='".$username."'";
910
$result = mysql_query($query);
1011
$fields = mysql_fetch_array($result);
1112
$currhash = crypt($_POST['password'], $fields['salt']);
1213
if($currhash == $fields['hash']) {
13-
$_SESSION['username'] = $_POST['username'];
14+
$_SESSION['username'] = $username;
1415
header("Location: index.php");
1516
} else
1617
header("Location: login.php?error=1");
1718
} else if($_POST['action']=='register') {
19+
$email = mysql_real_escape_string($_POST['email']);
1820
connectdb();
19-
$query = "SELECT salt,hash FROM users WHERE username='".$_POST['username']."'";
21+
$query = "SELECT salt,hash FROM users WHERE username='".$username."'";
2022
$result = mysql_query($query);
2123
if(mysql_num_rows($result)!=0)
2224
header("Location: login.php?exists=1");
2325
else {
2426
$salt = randomAlphaNum(5);
2527
$hash = crypt($_POST['password'], $salt);
26-
$sql="INSERT INTO `users` ( `username` , `salt` , `hash` , `email` ) VALUES ('".$_POST['username']."', '$salt', '$hash', '".$_POST['email']."')";
28+
$sql="INSERT INTO `users` ( `username` , `salt` , `hash` , `email` ) VALUES ('".$username."', '$salt', '$hash', '".$email."')";
2729
mysql_query($sql);
2830
header("Location: login.php?registered=1");
2931
}

‎solve.php

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@
4141
?>
4242
<h1><small>Submit Solution</small></h1>
4343
<?php
44-
if(isset($_GET['id'])) {
44+
if(isset($_GET['id']) and is_numeric($_GET['id'])) {
4545
$query = "SELECT * FROM problems WHERE sl='".$_GET['id']."'";
4646
$result = mysql_query($query);
4747
$row = mysql_fetch_array($result);
@@ -52,18 +52,20 @@
5252
?>
5353
<hr/>
5454
<?php
55-
$query = "SELECT * FROM solve WHERE (problem_id='".$_GET['id']."' AND username='".$_SESSION['username']."')";
56-
$result = mysql_query($query);
57-
$num = mysql_num_rows($result);
58-
$fields = mysql_fetch_array($result);
55+
if(is_numeric($_GET['id'])) {
56+
$query = "SELECT * FROM solve WHERE (problem_id='".$_GET['id']."' AND username='".$_SESSION['username']."')";
57+
$result = mysql_query($query);
58+
$num = mysql_num_rows($result);
59+
$fields = mysql_fetch_array($result);
60+
}
5961
?>
6062
<form method="post" action="eval.php">
6163
<?php if($num == 0)
6264
echo('<input type="hidden" name="ctype" value="new"/>');
6365
else
6466
echo('<input type="hidden" name="ctype" value="change"/>');
6567
?>
66-
<input type="hidden" name="id" value="<?php echo($_GET['id']);?>"/>
68+
<input type="hidden" name="id" value="<?php if(is_numeric($_GET['id'])) echo($_GET['id']);?>"/>
6769
<input type="hidden" name="lang" id="hlang" value="<?php if($num == 0) echo('c'); else echo($fields['lang']);?>"/>
6870
<div class="btn-group">
6971
<div id="blank"></div>

‎update.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
include('functions.php');
33
connectdb();
44
if($_POST['action']=='email') {
5-
mysql_query("UPDATE users SET email='".$_POST['email']."' WHERE username='".$_SESSION['username']."'");
5+
mysql_query("UPDATE users SET email='".mysql_real_escape_string($_POST['email'])."' WHERE username='".$_SESSION['username']."'");
66
header("Location: account.php?changed=1");
77
} else if($_POST['action']=='password') {
88
$query = "SELECT salt,hash FROM users WHERE username='".$_SESSION['username']."'";

0 commit comments

Comments
 (0)