22 lines
576 B
Markdown
22 lines
576 B
Markdown
# Sploit 1
|
|
|
|
**Flagstore 1. Private posts (their content)**
|
|
|
|
**Vulnerability:** A bug in code allows logging in as any user with password - `password`.
|
|
|
|
**Fix:** Add a `$` sign before hashing the password in the `api-user-register` and `api-user-login` functions.
|
|
|
|
# Sploit 2
|
|
|
|
**Flagstore 2. Private posts (their content)**
|
|
|
|
**Vulnerability:** An ineffective `db-escape` function and its absence in the `db-list-user-posts` function for `user_token` field.
|
|
|
|
**Fix:** Change the `db-escape` function to:
|
|
```bash
|
|
db-escape() {
|
|
local str="$1"
|
|
echo "${str//\'/\\\'}"
|
|
}
|
|
```
|