phpBB "postorder" Parameter Cross Site Scripting

Hangin' Around Joined: Feb 20, 2004 Posts: 29

phpBB "postorder" Parameter Cross Site Scripting Vulnerability

I don't know how much this affects PHP-Nuke, since the GET array is checked against "<script>" strings, but could somebody commend on this?

Posted: Mon Mar 01, 2004 8:51 am

In viewtopic.php find:

Code:

// 


// Decide how to order the post display 


// 


if ( !empty($HTTP_POST_VARS['postorder']) || !empty($HTTP_GET_VARS['postorder']) ) 


{ 


   $post_order = (!empty($HTTP_POST_VARS['postorder'])) ? $HTTP_POST_VARS['postorder'] : $HTTP_GET_VARS['postorder']; 


   $post_time_order = ($post_order == "asc") ? "ASC" : "DESC"; 


} 


else 


{ 


   $post_order = 'asc'; 


   $post_time_order = 'ASC'; 


}

Replace with:

Code:

// 


// Decide how to order the post display 


// 


if ( !empty($HTTP_POST_VARS['postorder']) || !empty($HTTP_GET_VARS['postorder']) ) 


{ 


   $post_order = (!empty($HTTP_POST_VARS['postorder'])) ? htmlspecialchars($HTTP_POST_VARS['postorder']) : htmlspecialchars($HTTP_GET_VARS['postorder']); 


   $post_time_order = ($post_order == "asc") ? "ASC" : "DESC"; 


} 


else 


{ 


   $post_order = 'asc'; 


   $post_time_order = 'ASC'; 


}


if (!eregi("^((asc)|(desc))$",$post_order) ) 


{ 


        message_die(GENERAL_ERROR, 'Selected post order is not valid'); 


}

To test it view any topic and at the end of the url add:

Code:

&postorder=chatserv

Not the result kiddies would expect.

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

See this update [ Only registered users can see links on this board! Get registered or login! ]

Posted: Fri Mar 05, 2004 5:00 pm

Updated mine as well, even while what i had first suggested would do the trick it can't hurt to have both methods., not only do you block the attempt but you let the lamer know you patch your files.

Posted: Fri Mar 05, 2004 5:03 pm

Oh I totally agree. I just wanted to let everyone know what the 'official' code was, from the authoring group. Saves answering the questions that would probably come Smile