PHP Melody websites running anything from v2.2 to v2.7.1 are vulnerable to SQL injection and should be patched immediately as instructed below. Alternatively, you can download the v2.7.2 update package form your Customer Account with us.
To manually patch the issue, please open: /include/functions.php
Find:
$id = ($list_id != false) ? $list_id : $list_uniq_id; $get_by_id = ($list_id != false) ? 'list_id' : 'list_uniq_id';
Replace with:
if ($list_uniq_id != false && ctype_alnum($list_uniq_id) === false)
{
return false;
}
$id = ($list_id != false) ? (int) $list_id : secure_sql($list_uniq_id);
$get_by_id = ($list_id != false) ? 'list_id' : 'list_uniq_id';
Find:
$sql = "SELECT list_uniq_id FROM pm_playlists WHERE list_id = $list_id";
Replace with:
$list_id = secure_sql($list_id); $sql = "SELECT list_uniq_id FROM pm_playlists WHERE list_id = $list_id";
Find:
$sql = 'SELECT * FROM pm_playlists WHERE user_id = '. $user_id;
Replace with:
$user_id = secure_sql($user_id); $sql = 'SELECT * FROM pm_playlists WHERE user_id = '. $user_id;
Leave a Reply