El Lunes, 15 de Enero de 2007 11:19, Manolo escribió:
> [Repeated message without URLs]
>
>
> I'm running under Cherokee a CMS called sNews. Recently, it was
> discovered a vulnerability by SQL-injection that was quickly patched
> for apache-servers.
>
> The patch is done on .htaccess files. It consists in the following
> redirection rules:
>
> RewriteCond %{QUERY_STRING} (\"|%22).*(\>|%3E|<|%3C).* [NC]
> RewriteRule ^(.*)$ error_logger.php [NC]
> RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC]
> RewriteRule ^(.*)$ error_logger.php [NC]
> RewriteCond %{QUERY_STRING} (javascript:).*(\;).* [NC]
> RewriteRule ^(.*)$ error_logger.php [NC]
> RewriteCond %{QUERY_STRING}
> (\;|\'|\"|\%22).*(union|select|insert|drop|update|md5|benchmark|or|and|if).
>* [NC]
> RewriteRule ^(.*)$ error_logger.php [NC]
> RewriteRule (,|;|<|>|'|`) log.php [NC]
>
> (so, it captures some suspicious code in address line and redirects it
> to file 'log.php' that warns by email)
>
> My question is: does this vulnerability affect cherokee-servers? If
> yes, how can I write rules equivalent to these "QUERY_STRING" ones in
> my site definition?
>The question is...have you tried on your cherokee site? Is it vulnerable? -- Manuel Arostegui Ramirez. Electronic Mail is not secure, may not be read every day, and should not be used for urgent or sensitive issues. _______________________________________________ Cherokee mailing list [email protected] http://cherokee-project.com/cgi-bin/mailman/listinfo/cherokee
