NukeSentinel 2.5.05:<br>Code: if(!ereg(&quot;([0-9]{1,3})\\.([0-9]{1,3})\\.([0-9]{1,3})\\.([0-9]{1,3})&quot;,<br>$nsnst_const[&#39;remote_ip&#39;])) {$nsnst_const[&#39;remote_ip&#39;] = &quot;none&quot;; }<br>Results: File Disclosure (with a nice sql injection) + SQL Injection (includes/nsbypass.php)
<br><br>NukeSentinel 2.5.06 (they added ^ but they forgot to add $):<br>Code: if(!ereg(&quot;^([0-9]{1,3})\\.([0-9]{1,3})\\.([0-9]{1,3})\\.([0-9]{1,3})&quot;,<span style="font-family: monospace;"><br></span>$nsnst_const[&#39;remote_ip&#39;])) {$nsnst_const[&#39;remote_ip&#39;] = &quot;none&quot;; }
<br>Results: SQL Injection (includes/nukesentinel.php / includes/nsbypass.php)<br><br>NukeSentinel 2.5.07 (includes/nukesentinel.php corrected):<br>Code: if(!ereg(&quot;^([0-9]{1,3})\\.([0-9]{1,3})\\.([0-9]{1,3})\\.([0-9]{1,3})$&quot;,
<br>$nsnst_const[&#39;remote_ip&#39;])) { $nsnst_const[&#39;remote_ip&#39;] = &quot;none&quot;; }<br><br>There is always the SQL Injection in includes/nsbypass.php.<br>