| Author |
Message |
ballymuntrev
Hangin' Around
Joined: Mar 22, 2004
Posts: 49
|
 Posted:
Fri Mar 26, 2004 1:41 pm |
 
|
ffs, another one ! I reckon the phpBB codeing group should employ chatserv and Raven to look over their code and improve *before* they ever release it.
Any idea's guys on how to fix it ?
That link is the direct link to the exploit. |
|
|
 
|
|
Raven
Site Admin/Owner
Joined: Aug 27, 2002
Posts: 16986
Location: Kansas
|
| Posted:
Fri Mar 26, 2004 1:54 pm |
|
You know, this is pathetic. I'm sorry to be so harsh, but it is. Actually they should pass their code by the guy who wrote the exploit  |
|
|
 
|
|
ballymuntrev
Hangin' Around
Joined: Mar 22, 2004
Posts: 49
|
| Posted:
Fri Mar 26, 2004 2:11 pm |
|
Here is the problem code of privmsg.php
EDIT: I'll just remove the code here that I entered, in case it confuses things  |
Last edited by ballymuntrev on Fri Mar 26, 2004 2:25 pm; edited 1 time in total |
|
|
|
|
Raven
Site Admin/Owner
Joined: Aug 27, 2002
Posts: 16986
Location: Kansas
|
| Posted:
Fri Mar 26, 2004 2:14 pm |
|
I've read the exploit and ultimately it's still the UNION exploit, if I read it correctly. The code isn't quoted properly. |
|
|
|
|
|
chatserv
The Mouse Is Extension Of Arm
Joined: May 02, 2003
Posts: 1396
Location: Puerto Rico
|
| Posted:
Fri Mar 26, 2004 2:39 pm |
|
The hack alert script and similar protection lines block this attack, i assume one is to remove the . in $pm_sql_user .= " but i'll wait for phpBB group's reaction.
sigh |
|
|
|
|
|
Tank863
New Member
Joined: May 29, 2003
Posts: 16
|
| Posted:
Fri Mar 26, 2004 10:10 pm |
|
I have tried this on my site...
Raven's Hack Alert stopped it and sent me an email.
Protector Stopped it and recorded it.
Admin Secure sent me an email and stopped it.
Good deal..
Tank863 |
|
|
|
|
|
Johan1982
New Member
Joined: Oct 23, 2003
Posts: 24
|
| Posted:
Fri Mar 26, 2004 11:26 pm |
|
|
|
|
|
Johan1982
New Member
Joined: Oct 23, 2003
Posts: 24
|
| Posted:
Fri Mar 26, 2004 11:58 pm |
|
This I do not understand, privmsg.php comes as it says the patch  |
|
|
|
|
|
Johan1982
New Member
Joined: Oct 23, 2003
Posts: 24
|
| Posted:
Sun Mar 28, 2004 8:43 pm |
|
| chatserv wrote: | The hack alert script and similar protection lines block this attack, i assume one is to remove the . in $pm_sql_user .= " but i'll wait for phpBB group's reaction.
sigh |
Correct, check
Remove the . . |
|
|
|
|
|
chatserv
The Mouse Is Extension Of Arm
Joined: May 02, 2003
Posts: 1396
Location: Puerto Rico
|
| Posted:
Sun Mar 28, 2004 11:43 pm |
|
The current zip and the PHP-Nuke Patched version have it already removed, i took it off the day i posted that comment and since nothing seemed to break i went ahead and edited the file. |
|
|
|
|
|
|
|
|
|
![[Valid RSS]](http://www.ravenphpscripts.com/images/valid-rss.png "Validate my RSS feed"){kind=small}
:: 
::
