I'm running under Cherokee a CMS called sNews
(http://www.solucija.com). Recently, it was discovered a vulnerability
by SQL-injection that was quickly patched for apache-servers.
The patch is done on .htaccess files. It consists in the following
redirection rules:
RewriteCond %{QUERY_STRING} (\"|%22).*(\>|%3E|<|%3C).* [NC]
RewriteRule ^(.*)$ error_logger.php [NC]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC]
RewriteRule ^(.*)$ error_logger.php [NC]
RewriteCond %{QUERY_STRING} (javascript:).*(\;).* [NC]
RewriteRule ^(.*)$ error_logger.php [NC]
RewriteCond %{QUERY_STRING}
(\;|\'|\"|\%22).*(union|select|insert|drop|update|md5|benchmark|or|and|if).*
[NC]
RewriteRule ^(.*)$ error_logger.php [NC]
RewriteRule (,|;|<|>|'|`) log.php [NC]
(so, it captures some suspicious code in address line and redirects it
to file 'log.php' that warns by email)
My question is: does this vulnerability affect cherokee-servers? If
yes, how can I write rules equivalent to these "QUERY_STRING" ones in
my site definition?
TIA
--
Manuel Pancorbo Castro
_______________________________________________
Cherokee mailing list
[email protected]
http://cherokee-project.com/cgi-bin/mailman/listinfo/cherokee
