Hi,
Postfixadmin has an SQL injection vulnerability. This vulnerability is only
exploitable by authenticated users able to create new aliases. If the alias
contains SQL code, the list-virtual.php overview triggers the vulnerability.
The vulnerability was fixed upstream in this commit:
http://sourceforge.net/p/postfixadmin/code/1650
Please assign a CVE name for this issue.
/branches/postfixadmin-2.3/functions.inc.php Diff Switch to side-by-side view
--- a/branches/postfixadmin-2.3/functions.inc.php
+++ b/branches/postfixadmin-2.3/functions.inc.php
@@ -9,14 +9,14 @@
* Further details on the project are available at :
* http://www.postfixadmin.com or http://postfixadmin.sf.net
*
- * @version $Id: functions.inc.php 1638 2014-02-13 20:12:43Z christian_boltz $
+ * @version $Id: functions.inc.php 1650 2014-02-19 12:27:02Z christian_boltz $
* @license GNU GPL v2 or later.
*
* File: functions.inc.php
* Contains re-usable code.
*/
-$version = '2.3.6';
+$version = '2.3.7';
/**
* check_session
@@ -2175,6 +2175,8 @@
global $CONF, $table_alias;
$stat_string = "";
+ $show_alias = escape_string($show_alias);
+
$stat_goto = "";
$stat_result = db_query ("SELECT goto FROM $table_alias WHERE address='$show_alias'");
if ($stat_result['rows'] > 0)
