Took a closer look at SolusVM 1.14. Current findings are:
Lots of potential SQLi's with $db->query() (their mysql_query(), essentially) involving lack of proper input validation. Lots of SQL queries where it's like "SELECT * FROM database WHERE fooid > $value" -- $value needs to be first cast to int, and then validated. Right now, SolusVM looks like this in a lot of places (code fragments are psuedocode illustrating the problem, not directly from SolusVM):
$start = $_POST['start'];
$res = $db->query("SELECT * FROM foolog WHERE id > $start");
This should be more like:
$start = (int) $_POST['start'];
if ($start > 0) {
$res = $db->query("SELECT * FROM foolog WHERE id > {$start}");
} else {
$res = null;
}
There are literally tons of these. Man, if I were SolusVM I would be asking CNS Group for a refund.
As far as I can tell, they haven't really fixed anything and have basically bandaged up some of the more rotten areas of the code that had public exploits flying around care of that localhost.re guy. Oh, and the CSRF thing, but that's nothing compared to these validation errors.
