[28192] in bugtraq
Anyone can read all XOOPS private messages
daemon@ATHENA.MIT.EDU (Val Deux)
Fri Dec 13 12:18:40 2002
Date: 13 Dec 2002 15:32:36 -0000
Message-ID: <20021213153236.29646.qmail@mail.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: Val Deux <valdeux@aol.com>
To: bugtraq@securityfocus.com
www.phpsecure.org advisory.
In french : http://www.phpsecure.org/?zone=pComment&d=101
By valdeux
Publiacted on december, 13th 2002
As most part of PHP CMS, XOOPS allows users to send and receive Private
Messages (PMs), that are saved on the DataBase.
We found how all messages are readable.
And sure, we give you a solution.
Product : XOOPS
Version : RC3 (tested)
File : /pmlite.php
Bug :
if ($reply == 1) {
$pm = new XoopsPM($msg_id);
$pm_uname = XoopsUser::getUnameFromId($pm->getVar
("from_userid"));
$replytext = "[quote]\n";
$replytext .= sprintf(_PM_USERWROTE,$pm_uname);
$replytext .= "\n".$pm->getVar("msg_text", "E")."\n
[/quote]";
Solution :
A patched file is available on www.phpsecure.org :
http://www.phpsecure.org/index.php?zone=pPatchA&sAlpha=x
patch :
ligne 76 : if($pm->getVar("to_userid") != $xoopsUser->getVar
("uid"))
ligne 77 : die("Désolé, c'est patché :)<br><br><a
href=\"http://www.phpsecure.org\">phpSecure();</a>");
Thanxxx :
Magistrat for his website (www.blocus-zone.com) that allows me to
test XOOPS every day :p
PhpSecure Team (www.phpsecure.org, don't forget ;))
xoops.org, because their CMS is a nice one. Let's secure it ;)
