Waraxe IT Security Portal

Heintz · Valuable expert

http://www.securityfocus.com/archive/1/407701/30/0/threaded

Vendor notified at and partial patch:

http://forums.xmbforum.com/viewthread.php?tid=754523

firstly the input validation at xmb.php:

foreach ($global as $num => $array) {

if (is_array($array)) {

extract($array, EXTR_OVERWRITE);

}

}

this should put to not overwrite any variables cause

it overwrite server set variables too. this creates problems

when user submits a additional field in form:

<input type="text" name="_SERVER[REMOTE_ADDR]" value="555.555.555.555">

secondly there is a case of sql injection in include/u2u.inc.php

line ~491:

Code:

$in = '';

foreach ( $u2u_select as $value ) {

if ( $GLOBALS['type'.$value] != 'outgoing' ) {

$in .= ( empty( $in ) ) ? "$value" : ",$value";

}

}

...

$db->query( "UPDATE $table_u2u SET readstatus='no' WHERE u2uid IN($in) AND owner='$self[username]'" );

the variable $in is not actually validated and could and will cause problems if not fixed.

Greets #rainbowcrack and http://www.waraxe.us

thought i disclose an old issue, sorry for greets being short, but i didnt think it was a very big thing to greet about at the moment Smile

waraxe · Site admin

Congrats, Heintz. Nice work!

Twist · Regular user

so how and what do i do, using this to take over someones forum...

slimjim100 · Valuable expert

Great Work Heintz! Plain-Text.info loves you Razz

miqrogroove · Beginner

Hello and thank you all for this information. I was given the opportunity to take over XMB development last year. Fixing this bug was one of my first official acts.

I could not find the original notification about this bug, so I have forwarded the original link to the new CVE vendor statement.

I will personally handle any new security notices for XMB. You are welcome to re-test the new versions 1.9.10 and 1.9.11.

Enjoy

waraxe · Site admin

OK, XMB will be in my TODO list Smile