PDA

View Full Version : Security question - database query related


Macsee
04-24-2014, 06:33 PM
This thread (http://www.vbulletin.com/forum/forum/vbulletin-3-8/vbulletin-3-8-questions-problems-and-troubleshooting/424590-remove-c99madshell-v-2-0-madnet-edition?p=3641037#post3641037) suggests the following query to find base64 in the database:

SELECT styleid, title, template FROM template WHERE template LIKE '%base64%' OR template LIKE '%exec%' OR template LIKE '%system%' OR template like '%pass_thru%' OR template like '%iframe%';


However, I get errors when I run it

My tables all have a prefix of st1 in the table name. Could anyone please tell me the syntax for the query. I tried the following but it didn't work.
SELECT styleid, title, st1template FROM st1template WHERE st1template LIKE '%base64%' OR st1template LIKE '%exec%' OR st1template LIKE '%system%' OR st1template like '%pass_thru%' OR st1template like '%iframe%';

Similarly I would like to run the other query in that thread which is also one I'd need to change:
SELECT title, phpcode, hookname, product FROM plugin WHERE phpcode LIKE '%base64%' OR phpcode LIKE '%exec%' OR phpcode LIKE '%system%' OR phpcode like '%pass_thru%' OR phpcode like '%iframe%';

Thanks.

kh99
04-24-2014, 07:08 PM
You should only need to add your prefix to the table name, the one right after FROM. So the first one should be:
SELECT styleid, title, template FROM s1template WHERE template LIKE '%base64%' OR template LIKE '%exec%' OR template LIKE '%system%' OR template like '%pass_thru%' OR template like '%iframe%';