phpBB "postorder" Parameter Cross Site Scripting

karakas · Hangin' Around Joined: Feb 20, 2004 Posts: 29

Only registered users can see links on this board!
Get registered or login to the forums!

I don't know how much this affects PHP-Nuke, since the GET array is checked against "<script>" strings, but could somebody commend on this?

chatserv · Posted: Mon Mar 01, 2004 8:51 am

In viewtopic.php find:

Code:

//
// Decide how to order the post display
//
if ( !empty($HTTP_POST_VARS['postorder']) || !empty($HTTP_GET_VARS['postorder']) )
{
$post_order = (!empty($HTTP_POST_VARS['postorder'])) ? $HTTP_POST_VARS['postorder'] : $HTTP_GET_VARS['postorder'];
$post_time_order = ($post_order == "asc") ? "ASC" : "DESC";
}
else
{
$post_order = 'asc';
$post_time_order = 'ASC';
}

Replace with:

Code:

//
// Decide how to order the post display
//
if ( !empty($HTTP_POST_VARS['postorder']) || !empty($HTTP_GET_VARS['postorder']) )
{
$post_order = (!empty($HTTP_POST_VARS['postorder'])) ? htmlspecialchars($HTTP_POST_VARS['postorder']) : htmlspecialchars($HTTP_GET_VARS['postorder']);
$post_time_order = ($post_order == "asc") ? "ASC" : "DESC";
}
else
{
$post_order = 'asc';
$post_time_order = 'ASC';
}
if (!eregi("^((asc)|(desc))$",$post_order) )
{
message_die(GENERAL_ERROR, 'Selected post order is not valid');
}

To test it view any topic and at the end of the url add:

Code:

&postorder=chatserv

Not the result kiddies would expect.

Raven · Posted: Fri Mar 05, 2004 4:46 pm

See this update

Only registered users can see links on this board!
Get registered or login to the forums!

chatserv · Posted: Fri Mar 05, 2004 5:00 pm

Updated mine as well, even while what i had first suggested would do the trick it can't hurt to have both methods., not only do you block the attempt but you let the lamer know you patch your files.

Raven · Posted: Fri Mar 05, 2004 5:03 pm

Oh I totally agree. I just wanted to let everyone know what the 'official' code was, from the authoring group. Saves answering the questions that would probably come Smile