Holo security fix #2
Good evening habboons! You are lucky today, thanks to good ole Niggus + Aaron from ForceHotel.com, another SQL vulnerability in the emulator was detected. Well, actually ‘thanks’ to the scriptkiddies that tried to abuse it…
We were discussing the weak security of running MySQL under it’s almighty root account, and after I told him to create a limited account and disable file functions etc for it, errors showed up in the server log. A scriptkiddie was using this SQL vulnerability in an attempt to create a new database table, but was caught in the act: he failed to use it properly thus leading into errors in the server log, notifying Aaron of a SQL exploit. Congratulations, the ‘I failed at haxing’-award goes out to you. 
This is a SQL vulnerability, which allows badguys to execute any SQL query that they want at your database. This includes modifying data, but, under an insecure server setup, creation of new files in the filesystem like shells etc: so they can take over your server and stuff! Bad times! How to fix?
1) Open up virtualUser.cs of the emulator sourcecode
2) Search for:
dbClient.runQuery(“UPDATE users_badges SET slotid = ‘” + slotID + “‘ WHERE userid = ‘” + this.userID + “‘ AND badgeid = ‘” + Badge + “‘ LIMIT 1″); // update slot
replace it with…
dbClient.AddParamWithValue(“badge”, Badge);
dbClient.runQuery(“UPDATE users_badges SET slotid = ‘” + slotID + “‘ WHERE userid = ‘” + this.userID + “‘ AND badgeid = @badge LIMIT 1″); // update slot
3) Save and recompile
Woop, another SQL vulnerability patch. Provided free of charge by Pvt. Nillus, with help from ForceHotel and a noob scripter.
Another tip: don’t use MySQL’s root user for your private server: it’s not safe. Create a limited account like ‘holo_user’, and only give it access to SELECT, UPDATE, INSERT, DELETE. Then configure your emulator and CMS to use this account. This prevents them from using the file functions, incase they find a SQL exploit. Good evening boons, and stay safe. 
Don’t forget to apply the previously published fix too, it’s another SQL vulnerability in the emulator: click here for the other patch
Also, if you are feeling generous: you can always donate to me with PayPal. Any amount is welcome, I have never charged money for my work so any amount is welcome. Thank you!
Also: Angelo check it out.
Thanks!…
Thanks for all your insight. This site has been really helpful to me….
[...]Sites of interest we have a link to[...]……
[...]usually posts some very interesting stuff like this. If you’re new to this site[...]……
Good but not the best…
Excellent thought although it is not on everyone’s mind like Dane Cook or is it?…
Top Blogger Post Here…
This is without doubt a best blog articles I have glanced over in the past few days….
Awesomeness…
We ought to be gloating for this….
Digg…
While checking out DIGG today I noticed this…
Looking around…
I like to browse in various places on the online world, regularly I will just go to Digg and follow thru…
and others. these rolls are manufactured under…
the total production system which consists of a sophisticated quality control system from raw material procurement to product packing and shipment, and a certain technology and know-how of heat treatment are applied by high frequency induction, polishi…
no matter how much experience you have in…
motorhoming, it is vital that you keep abreast of the legal aspects of owning a motorhome. what follows is but a brief resume of points of which you should be aware.1. what rights do i have against the seller?a vehicle bought…
to play a role in what the…
cost is going to be and the area in which you are looking to purchase will matter as well. if you purchase in bulk amounts you will find that the cost is going to be more affordable than if you were…
Quick Payday Loans Now…
[...]there are many alot more zero cost hyperlinks to always be given out, since you can easily find from the adhering to[...]…
Sites we Like……
[...] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose [...]……
Air Jordan 22…
[...]nods all around Nutpaw amid smile widens[...]…
Sites we Like……
[...] Every once in a while we choose blogs that we read. Listed below are the latest sites that we choose [...]……
That’s Right!…
This is a really good blog. Good work!…
windows 8…
There used to be someone else that wrote something identical, but you probably did a much better job. Thanks for the read….
he will take the bac or blood…
alcohol content and have a result of above 0.08% and if the result is positive the driver will be facing a dui charge.a person charged of dui in los angeles has the right or privilege of hiring a los angeles dui…
Nice Focus….
I really like the direction you’ve decided to take this blog….
Custom Window Treatments in Fairfax VA…
Including Blinds , Shades, Shutters and Draperies….
[...]always a big fan of linking to bloggers that I love but don’t get a lot of link love from[...]……
[...]just beneath, are numerous totally not related sites to ours, however, they are surely worth going over[...]……
Woodbridge Solar Film providing the highest quality commercial and residential window tinting in Virginia….
Huper Optik Ceramic Window Films are low glare and block over 99% of harmful UV Rays….
Air Jordan 4…
[...]Like, soon after a baby cool did you talk to Kathryn? Hmm did people around the globe solicit her? =D[...]…
[...]we like to honor many other internet sites on the web, even if they aren’t linked to us, by linking to them. Under are some webpages worth checking out[...]……
[...]Here are some of the sites we recommend for our visitors[...]……
Tumblr article…
I saw a writer talking about this on Tumblr and it linked to…
10 great ways to improve your website ranking and profit in no time !…
[...]just below, are some totally unrelated sites to ours, however, they are definitely worth checking out[...]…
… [Trackback]…
[...] Find More on: blog.nillus.net/post/holo-security-fix-2/ [...]…
Yesturdays work for tomorrow – a look at some examples…
Noticed this example, via jon halign on Live Journal and imagine it to be extremely informative and too the point…
Solar Lights…
[...]here are a few links to web sites I always connect to seeing that we believe there’re seriously worth checking out[...]…
same main use — they use the…
lenses to show each eye a different image which are then processed by the brain to form one three-dimensional image in your mind.autostereoscopic tvs rely on either lenticular lenses or parallax barrier. lenticular lenses are tiny cylindrical plastic l…
Air Force 9…
[...]i fancy visualizing bes because a at the same time think of what are reading soon ‘ read.[...]…
[...]we like to honor many other internet sites on the web, even if they aren’t linked to us, by linking to them. Under are some webpages worth checking out[...]……
[...]Here are some of the sites we recommend for our visitors[...]……
able to watch all of my favorite…
movies and tv shows in the highest possible quality out there today. i had gotten so used to watching everything in the standard definition, so i was blown away by how clear the picture was and how the characters just seemed…
You should check this out…
[...] Wonderful story, reckoned we could combine a few unrelated data, nevertheless really worth taking a look, whoa did one learn about Mid East has got more problerms as well [...]……
person. if this does take place and…
also the gps child locator watch is removed or tampered with an alert is sent to your cell phone and email. even though this will not stop an undesirable incident, it may be invaluable in tracking a lost or errant kid.picture…
i was impressed with the infomercial, i…
didn’t learn what made the little giant ladder so cool until i toured their factory. an r&d guy answered all my questions as i learned how the little giant ladder was made to be the safest, strongest, most versatile ladder in…
gain answers about our health. spend a…
few minutes each day devoted to listening to this voice. it may appear as a gut feeling, a hunch, an image, a sound, a memory, an instant knowing-as if a light bulb suddenly switched on. learn to trust the signals your…
Air Max 1…
[...]oh wi experimented with an infant free hug friday task again, but it seemed adore almost all people forgot…..[...]…
suffer. many will say it doesn’t matter….
we shouldn’t lack confidence because of our penis size. but we don’t live in the ’should’ world do we? we live in the real world and in the real world a few extra inches would do wonders for our confidence levels…
nutrients and equipment to help the hopeful…
gardener.most information produced by the scientists is available at the nurseries and garden centers in most cities and towns. the personnel on duty at these places are often experienced gardeners who have used the gardening tools and other products i…
Yesturdays work for tomorrow – a look at some examples…
Was shown this example, via jon McCormick on Twitter and believe it to be very informative and too the point…
Another Title…
I saw this really good post today….
Awesome website……
[...]check out this great blog which you might find interesting[...]……
find these kinds of helpful goods? they…
all are around you. in the event you would like a specific brand or even producer, vacation to the website could also discover coupon codes. internet internet sites this type of are superb resources. normally, you need to offer you an…
property management folsom…
[...]while the sites we link to below are completely unrelated to ours, we think they are worth a read, so have a look[...]…
20 of your preferred brand names coupons. …
backlinks are supplied beneath for printable grocery store coupons on manufacturer products and thorough specifics is also provided under on kohls coupon policy. this world wide web page presents for you some hyperlinks, weblogs, and common data …
than those taking a placebo. by taking…
1200 mg of coq10 daily, people suffering from parkinson’s disease were better able to feed and dress themselves, speak, walk, and bathe or shower by themselves and, therefore, maintained a greater independence for a longer time. although coq10 supplem…
prostate cancer). if you are concerned about…
your risk of creating prostate cancer, talk with your physician.finasteride just isn’t approved for use by females. in fact, it poses considerable danger to ladies of childbearing age. if you’re a pregnant woman, do not even manage crushed or broken …
these sections of law triggers specific illegal…
actions. therefore, the classes of criminal attorney are classified according to the criminal laws to take over particular procedures.sometimes being an attorney is a thankless job; some people see these lawyers as working for the bad guys. but in our …
etc. for e.g. to use your atv…
in muddy area, you should opt for mudding tires.there are different sizes, treads, and shapes of the tires. it is always suggested that you should not buy second hand tires for the daily use of your atv because in the used…
[...]Sites of interest we have a link to[...]……
[...]usually posts some very interesting stuff like this. If you’re new to this site[...]……