We also experienced the issue updating to version 3.8.1, where we could no longer access the WordPress dashboard (white screen of death).
SOLUTION: Revert back to previous version (version 3.8) until author can address the latest release issue.
Here is the link for previous verion: http://downloads.wordpress.org/plugin/leaguemanager.3.8.zip
This fixed our site(s) without having to modify core WP files!!
@ben52 ignore me and my solution.. i realised after that my plugin had deactivated. I will relook at this tonight.
@borellidesigns This is leaving you open to a published exploit allowing someone to get your admin username and password. I would deactivate if you can until a solution is found.
An SQL Injection vulnerability exists in the league_id parameter of a function call made by the leaguemanager_export page. This request is processed within the leaguemanager.php:
if ( isset($_POST[‘leaguemanager_export’]))
$lmLoader->adminPanel->export($_POST[‘league_id’], $_POST[‘mode’]);
Which does not sanitize of SQL injection, and is passed to the admin/admin.php page into the export( $league_id, $mode ) function which also does not sanitize for SQL injection
when making this call: $this->league = $leaguemanager->getLeague($league_id);
The information is then echoed to a CSV file that is then provided.
Since no authentication is required when making a POST request to this page,
i.e /wp-admin/admin.php?page=leaguemanager-export the request can be made with no established session.
Fix:
SOLUTION is: Revert back to previous version (version 3.8)
A possible fix for this would be to cast the league_id to an integer during any of the function calls. The following changes can be made in the leaguemanager.php file:
in the end of file change:
$lmLoader->adminPanel->export($_POST[‘league_id’], $_POST[‘mode’]);
with:
$lmLoader->adminPanel->export((int)$_POST[‘league_id’], $_POST[‘mode’]);
solution from: http://bot24.blogspot.it/2013/03/wordpress-leaguemanager-plugin-38-sql.html
for me it’s working.
if you want to stop the advise of upload in wordpress change the version from 3.8 to 3.8.1 on top of the same file: leaguemanager php.
Hay guys, please try the method suggested by Michael Dozark. It has worked for me. And thanks Michael for the solution.
