Upgrade your S9y (Serendipity) blog to a post-June 16th 2007 release ASAP

Any version 1.1 or later that pre-dates June 17th, when the SQL injection fix was committed, is vulnerable to an SQL injection attack. Any version before 1.1 is not affected, but I am just trying to get the word out so that there are some patched/fixed blogs out there.

Check your server's access logs and search for the 'commentMode' variable to see if malicious request have been issued to your blog already.

If you don't want to upgrade or can't upgrade for a certain reason, you can patch the code manually.

In the file include/functions_comments.inc.php and replace the single occurence of:

$type = $serendipity['GET']['commentMode'];

to

$type = serendipity_db_escape_string($serendipity['GET']['commentMode']);

You can read more about the problem and fixes here.

Direct link to the updated downloads are here.