broodwarmaps.net banner

BWMN Time
04/14/2021
07:33
News
new account
list users
Login:
name:
:PW.:
Replays
Map DB
ICCup
Map Access
New map
Edit map
 


Back to mainpage
SQL Injection 03/31/2021 08:17 AM
Posted by:panschk[FP]

Hey everyone :-)

Thanks a lot to Crackling who pointed out to me that BWMN has been vulnerable to SQL injection because the inputs were not sanitized. I did not know better when I implemented it back in the day, but at least I tried to fix it now, using a regex search/replace. With this I replaced over 300 places in the code base in one go. This is not perfect and a really serious hacker might still be able to get through, but certainly an improvement. It could also potentially break something, although my tests looked good. If I broke something that previously worked, let me know in the comments.

When doing this on Tuesday, I accidently applied the connection settings to an older backup of the databse, which is used for the 'update project' started but abandoned by mmmk: http://broodwarmaps.net/BWMN_dev/public/index.php




Update 2021-04-01: I added another fix that should hopefully fix SQL injection in all cases.

Comments:


Because of heavy spam on the map comments, it is needed to be logged in to post. We are sorry that this has to be done because nothing else stops spam bots
random map
  (4)TheEye1.03
Newest updates:
  (2)Eurydice 1.13
  (4)Bridging the G..
  (2)Clock Strikes ..
  (4)Oil Flow_0.81
  (4)Wavelet
  (2)Dodgy_Dunes
  (3)Tundra_0.95
  (4)GOOD NIGHT 1.1
  (4)Ferris wheel
  (4)Augustgrad
MOTM
  • month 4:
      (3)Tundra_0.95
  • MOTW
  • week 2021.01:
      (3) Lambda 1.0
  • Main Forum
  • Magna..(RedGoliath)
  • Edito..(Minerals)
  • No Fo..(Minerals)
  • Any g..(SvTv)
  • Feedback
  • This s..(triller1)
  • Rotati..(triller1)
  • Off Topic
  • Vetera..(ProTosS4Ev)
  • What's..(triller1)
  • Questi..(triller1)
  • Starcraft 2
  • announ..(triller1)
  • STARCR..(triller1)
  • Search Forum
    Articles:
     
  • How to make larvae spawn at the bottom right corner  
  • Worker pathing guide - How to debug and balance resour  
  • An elegant way of dealing with cliff asymmetry
  • Competition:
     
  • Innovative Naturals Competition  
  • Tourney Map Pack Aspirant Suggestions  
  • Maps That Need A Remake  
  • Think Quick Map Contest ($100 prize)