[17856] in bugtraq

home	help	back	first	fref	pref	prev	next	nref	lref	last	post

Re: Security problems with TWIG webmail system

daemon@ATHENA.MIT.EDU (=?iso-8859-1?Q?Jo=E3o_Gouveia?=)
Thu Nov 30 15:28:15 2000

Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id:  <016f01c05a39$6bd9de90$501fb00a@cerc.dgaccp.pt>
Date:         Wed, 29 Nov 2000 19:20:20 -0000
Reply-To: =?iso-8859-1?Q?Jo=E3o_Gouveia?= <cercthar@TELEWEB.PT>
From: =?iso-8859-1?Q?Jo=E3o_Gouveia?= <cercthar@TELEWEB.PT>
X-To:         geoff@BROCKU.CA
To: BUGTRAQ@SECURITYFOCUS.COM

Hi ,

(snip)
> Another option... in index.php3, replace the line:
>
> if( $vhosts[$SERVER_NAME] )
>
> with:
>
> if( $vhosts[$SERVER_NAME] &&
> !isset($HTTP_GET_VARS[vhosts]) )
>
> This essentially checks to make sure that the
> vhosts element was defined locally (in
> config/config.inc.php3), not in the URL.

I think that's not a eficient fix. That or I'm seeing strange things.
Try this: index.php3?HTTP_GET_VARS=&vhosts[twig.server.tld]=test

Best regards,

Joao Gouveia aka Tharbad

home	help	back	first	fref	pref	prev	next	nref	lref	last	post