{"action":"opened","issue":{"url":"https://api.github.com/repos/modxcms/evolution/issues/471","labels_url":"https://api.github.com/repos/modxcms/evolution/issues/471/labels{/name}","comments_url":"https://api.github.com/repos/modxcms/evolution/issues/471/comments","events_url":"https://api.github.com/repos/modxcms/evolution/issues/471/events","html_url":"https://github.com/modxcms/evolution/issues/471","id":127957630,"number":471,"title":"Possible SQL Injection?","user":{"login":"terrybarth","id":526281,"avatar_url":"https://avatars.githubusercontent.com/u/526281?v=3","gravatar_id":"","url":"https://api.github.com/users/terrybarth","html_url":"https://github.com/terrybarth","followers_url":"https://api.github.com/users/terrybarth/followers","following_url":"https://api.github.com/users/terrybarth/following{/other_user}","gists_url":"https://api.github.com/users/terrybarth/gists{/gist_id}","starred_url":"https://api.github.com/users/terrybarth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/terrybarth/subscriptions","organizations_url":"https://api.github.com/users/terrybarth/orgs","repos_url":"https://api.github.com/users/terrybarth/repos","events_url":"https://api.github.com/users/terrybarth/events{/privacy}","received_events_url":"https://api.github.com/users/terrybarth/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-01-21T16:03:46Z","updated_at":"2016-01-21T16:03:46Z","closed_at":null,"body":"I have a site running Evo 1.0.15. I subscribe to SiteLock to monitor the site for malware. They sent me an alert about a possible SQL Injection.\r\n\r\n(I changed the page names below)\r\n\r\nUsing the GET HTTP method, SiteLock found that :\r\n \r\n+ The following resources may be vulnerable to blind SQL injection :\r\n \r\n+ The 'username' parameter of the /manager/processors/login.processor.php CGI :\r\n \r\n/manager/processors/login.processor.php?password=&rememberme=1&username=\r\n)+or+(1=1\r\n \r\n-------- output --------\r\nHTTP/1.1 200 OK\r\n-------- vs --------\r\nHTTP/1.1 406 Not Acceptable\r\n------------------------\r\n \r\n+ The 'start' parameter of the /page-name.html CGI :\r\n \r\n/page-name.html?start=10)+or+(1=1\r\n \r\n-------- output --------\r\nHTTP/1.1 200 OK\r\n-------- vs --------\r\nHTTP/1.1 406 Not Acceptable\r\n------------------------\r\n \r\nClicking directly on these URLs should exhibit the issue :\r\n(you will probably need to read the HTML source)\r\n"}}