search

Star2Billing / a2billing

A2Billing is a telecom switch and billing system capable of providing and billing a range of telecom products and services to customers such as calling card products, residential and wholesale VoIP termination, DID resale and callback services.
www.asterisk2billing.org
Other
181 stars 175 forks source link

Mail templates do not accept the string " or " #137

Open kpabijanskas opened 8 years ago

kpabijanskas commented 8 years ago

Hi A2billing devs,

We are using v2.2.0.

This can be reproduced every time.

If the string " or " (without the quotes, with spaces on both sides) appears in a mail template, when saving, it will get cut out of the template before being saved to the database. This only happens when there are spaces on both sides of the word "or" (not when there is only a space on one side).

Thanks.

dcitelecom commented 7 years ago

strings " if " and " or " are stripped when email is sent. Doesn't like apostrophe " ' " either. Makes it very difficult to write a proper sentence.

sbosio commented 6 years ago

This seems to be related to sanitization of strings before inserting data into the SQL database, in order to prevent code (specifically SQL) injection, but it's known to be a bad implementation of sanitization. Worst, it doesn't works either, as it can be bypassed. See: https://0x4148.com/2016/10/28/a2billing-rce/