[RSS Feed/News] escapeLike fails to escape backslashes

[XenForo]

Replacements it performs:

• % -> \%
• _ -> \_

However, it neglects to perform:

• \ -> \\

This means input such as this:
Code:

\%
Will become:
Code:

\\%
Which MySQL/MariaDB will interpret as a literal backslash followed by a LIKE wildcard.

While this could theoretically result in security vulnerabilities in some add-ons, I can't find any instances in which this would result in a security issue in vanilla XenForo; it just breaks certain searches.

ادامه مطلب...