Serendipity 1.1.2 released

This evening we were notified by fellow co-developer Sebastian Nohn about a full-disclosure posting about a Serendipity SQL injection matter. We have investigated this reported 0day issue, and can tell you that it is not a SQL injection,but instead "only"an SQL error display.

No SQL can be injected using the described method. Because of an invalid category ID, serendipity tries to show entries for that category, but the resulting SQL string contains an emtpy "(())" statement which makes the MySQL parser fail, and report the error on-screen. The SQL queries that Serendipity uses are not secret, and could be looked up in the sourcecode as well.

Even though we consider this issue to be fairly low-impact, Serendipity 1.1.2 has been released because of this, mainly to assure the public that we have addressed the issue. It is not critical that you upgrade to that release. If you do, it is sufficient to update the include/ file. The only change made to that function is documented here

We would also like to express, that we kindly appreciate all bug and security reports about Serendipity, and take them and our responsibility very seriously. Also rest assured that if you contact us developer first before publishing security advisories, we always cooperate, pay credit and fix issues immediately, as we have done in the past. So we look forward to working together with SaMuschie in the future, who seems to taking some serious work in checking security issues - good work on that! :-)

The latest release can be downloaded here. This fix has also been committed to the daily snapshots.


Trackback specific URI for this entry

  • No Trackbacks


Display comments as (Linear | Threaded)

Add Comment

E-Mail addresses will not be displayed and will only be used for E-Mail notifications.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.

BBCode format allowed