search

Geeklog-Core / geeklog

Geeklog - The Secure CMS.
https://www.geeklog.net
25 stars 19 forks source link

Double Check Filtering of variables for OAuth login #1088

Closed eSilverStrike closed 2 years ago

eSilverStrike commented 3 years ago

Found a lot of errors in the log which showed someone was trying a SQL injection via our OAuth login like this one below:

Sun 07 Feb 2021 18:09:23 EST - ###.###.###.### - OAuth login failed - there was no consumer available for the service:github);SELECT SLEEP(5)#

This should be double checked.

eSilverStrike commented 3 years ago

There wasn't an issue as its not compared in SQL. Did add some additional filtering though.