Possible code error

New Member Joined: May 18, 2007 Posts: 10

I've been having problems with some users performing functions on my site. The most recent problem was a single user. He attempted to register several times with no success. After finally getting registered, he tried to send a PM only to have that fail.

After reading several threads, there was one that directed me to look at "includes\nukesentinel.php". While examining the code near:

Code:

if (!isset($_COOKIE['admin']) OR !is_admin($_COOKIE['admin'])) {


  // Check for SCRIPTING attack


  // Copyright 2004(c) ChatServ

I found this line:

Code:

     (eregi("\([^>]*\"?[^)]*\)", $secvalue)) ||

My question is whether the ")" is correct in the ?[^)] section.

This is from Sentinel version 2.5.08.

Posted: Tue Jun 26, 2007 10:30 am

It would help if you would explain what problems this user was having exactly in registering, and what was Sentinel doing to prevent it?

What failed when he tried to send a PM?

Posted: Tue Jun 26, 2007 11:50 am

Well, I wasn't directly asking about my site problem, just the code variance.

But, since you asked. All of the errors were Abuse-Script errors. This is on a phpNuke 7.9 patched site running Sentinel 2.5.08.

First register attempt:

Code:

Reason: Abuse-Script


--------------------


User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)


Query String: joinkof.com/modules.php?name=Your_Account&op=activate&username=(Delta)


Get String: joinkof.com/modules.php?name=Your_Account&op=activate&username=(Delta)


Post String: joinkof.com/modules.php


Forwarded For: none


Client IP: none


Remote Address: 65.24.28.3


Remote Port: 64088


Request Method: GET

Another registration attempt:

Code:

Reason: Abuse-Script


--------------------


User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)


Query String:


joinkof.com/modules.php?name=Your_Account&amp;op=activate&amp;username=(Delta) D.O.


2526&amp;check_num=472ca5e3ec9b20e650b05c92123510e4


Get String:


joinkof.com/modules.php?name=Your_Account&amp;op=activate&amp;username=(Delta) D.O.


2526&amp;check_num=472ca5e3ec9b20e650b05c92123510e4


Post String: joinkof.com/modules.php


Forwarded For: none


Client IP: none


Remote Address: 65.24.28.3


Remote Port: 61741


Request Method: GET

Another registration attempt:

Code:

Reason: Abuse-Script


--------------------


User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)


Query String:


joinkof.com/modules.php?name=Your_Account&op=activate&username=(Delta)_D.O._2526&check_num=0254c4c61d19af7367be00fd412fe370


Get String:


joinkof.com/modules.php?name=Your_Account&op=activate&username=(Delta)_D.O._2526&check_num=0254c4c61d19af7367be00fd412fe370


Post String: joinkof.com/modules.php


Forwarded For: none


Client IP: none


Remote Address: 65.24.28.3


Remote Port: 60197


Request Method: GET

And the PM error (where he was trying to tell us about his problems):
[ Only registered users can see links on this board! Get registered or login! ]

Thanks for the help.

Posted: Tue Jun 26, 2007 1:13 pm

I think it is the parenthesis in his username that is tripping up Sentinel.

And in the PM he pasted HTML code into it which also caused Sentinel to trip.

Posted: Tue Jun 26, 2007 1:17 pm

If the user removes the brackets from the username, does it work?

Posted: Tue Jun 26, 2007 1:19 pm

Great minds think alike! Wink

Posted: Tue Jun 26, 2007 4:41 pm

So, there is no way to use parentheses in a username?

Posted: Tue Jun 26, 2007 5:39 pm

Apparently not with Sentinel... Wink

That can get passed on to the developers and we can see what they say...