Comment on Aardvark Topsites PHP 5.2.1 security vulnerabilities disclosure by Martyn

Martyn — Sun, 04 Apr 2010 11:51:12 +0000

running 5.2.1 here – I fixed the information disclosure 1 problem by adding a check for the start value being less than zero in search.php as follows

old code….

if (isset($FORM['start'])) {
$start = intval($FORM['start']);
if ($start > 0) {
$start–;
}
else {
$start = 0;
}

new code….

if (isset($FORM['start'])) {
$start = intval($FORM['start']);
if ($start > 0) {
$start–;
}
if ($start < 0) {
$start = 0;
}
else {
$start = 0;
}

Comments for Web Application Security