| Topic Archived |
View previous topic :: View next topic |
| Author |
Message |
purepersian
Heavy poster
 Offline
Joined: May 05, 2004
Posts: 197
Location: london
|
 Posted: Thu Sep 02, 2004 7:27 pm
Post subject: coppermine 1.3 security exploit |
|
ok someone kept posting messages and changing the username
so i disabled the username field in the image_comment.html file and somehow he was still able to edit usernames
so i then removed the edit button from comments and he is still changing usernames
i dont know how he does it but iv figured that he posts a message with his username FIRST then changes that message
but i dunno HOW
there must be a security exploit
_________________
Judge not, as you'll be judged first...
Borobiroon.com - Persian Community
Blue Water Media - Professional Webdesign
purepersian's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
latest
|
|
| Back to top |
|
 |
Śyama_Dāsa
Developer
Offline
Joined: Apr 19, 2004
Posts: 2048
Location: Dragonfly CMS Tribe
|
Posted: Thu Sep 02, 2004 10:09 pm
Post subject: Re: coppermine 1.3 security exploit |
|
www.cpgnuke.com/cvs/ht....php?g=1.8 [edited]
This features better input checking and all users are suggested to use this
_________________
AKA Akamu / Read these and your life will be successful | Find a Repair
--
Mods and Professional Support via YIM
Śyama_Dāsa's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
win32 / Apache 1.3.33 / MySQL 4.1.16/PHP 4.4/CPG-CVS ( browsers: Mozilla 1.7.x / IE6 / Opera 8.0)
Last edited by Śyama_Dāsa on Sat Sep 04, 2004 9:29 am; edited 1 time in total |
|
| Back to top |
|
|
64bitguy
Heavy poster
Offline
Joined: Apr 27, 2004
Posts: 248
Location: Manchester, NH USA
|
Posted: Fri Sep 03, 2004 12:40 am
Post subject: Re: coppermine 1.3 security exploit |
|
Can you give me the path where this file is supposed to be saved?
Thanks
_________________
Steph
64bit.us
The IT Portal for IT People!
64bitguy's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
2.6.9-11.ELsmp/Apache-1.3.33(Unix)/MySQL-4.0.25/PHP-4.4.0 (CGI-Mode)/Nuke7.6Patched31, Platinum7612-patched31,7.8patched31, Dragonfly (all)
|
|
| Back to top |
|
|
Trevor
Developer
Offline
Joined: Apr 19, 2004
Posts: 2170
Location: New York
|
Posted: Fri Sep 03, 2004 12:44 am
Post subject: Re: coppermine 1.3 security exploit |
|
/modules/coppermine/
Trevor's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Linux / 1.3.34 / 4.1.18 / 4.4.2 / CVS
|
|
| Back to top |
|
|
kjcdude
Newbie
Offline
Joined: Aug 27, 2004
Posts: 7
|
Posted: Fri Sep 03, 2004 1:15 am
Post subject: Re: coppermine 1.3 security exploit |
|
Thanks for the update.
Told about through the newsletter that was sent out.
kjcdude's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
----
|
|
| Back to top |
|
|
Zoologico
Heavy poster
Offline
Joined: Jun 10, 2004
Posts: 158
Location: Boston, MA, USA
|
Posted: Fri Sep 03, 2004 1:39 am
Post subject: Re: coppermine 1.3 security exploit |
|
| kjcdude wrote: |
Thanks for the update.
Told about through the newsletter that was sent out. |
I got the newsletter too, but I was too afraid to click it so I came here directly.
Thanks.
_________________
Miguel G. Perez
Zoologico's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Windows XP Pro/2.0.48/4.0.18/4.3.4/Dragonfly 9.0.4.0
|
|
| Back to top |
|
|
spotlight
Nice poster
Offline
Joined: Aug 10, 2004
Posts: 59
|
Posted: Fri Sep 03, 2004 1:41 am
Post subject: Re: coppermine 1.3 security exploit |
|
I upload the new db_input.php file also i make some changes in the config zone it let me upload photos and it looks like working but only if i use GD1 in the others modes don´t work and show difert types of errors the GD2 mode is better i think mi server don´t have installed the libraries ¿the GD2 works better?
Thanks 
spotlight's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
XP/?/MYSQL 2.../PHP 4.22/CPG :8.2b
|
|
| Back to top |
|
|
Śyama_Dāsa
Developer
Offline
Joined: Apr 19, 2004
Posts: 2048
Location: Dragonfly CMS Tribe
|
Posted: Fri Sep 03, 2004 3:33 am
Post subject: Re: coppermine 1.3 security exploit |
|
Yes it is your server... You should suggest they upgrade the server software GD2 has been out for a while...
Other options are Imagemagick and netpbm but don't ask us how to install them we don't know or have time to find out how in all situations...
_________________
AKA Akamu / Read these and your life will be successful | Find a Repair
--
Mods and Professional Support via YIM
Śyama_Dāsa's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
win32 / Apache 1.3.33 / MySQL 4.1.16/PHP 4.4/CPG-CVS ( browsers: Mozilla 1.7.x / IE6 / Opera 8.0)
|
|
| Back to top |
|
|
musox
Platinum Supporter
Offline
Joined: Apr 20, 2004
Posts: 325
|
Posted: Fri Sep 03, 2004 10:36 am
Post subject: Re: coppermine 1.3 security exploit |
|
Is this a CPGNuke CVS 8.3 fix only? I'm getting
| Quote:: |
| Fatal error: main(): Failed opening required 'includes/classes/phpmailer.php' (include_path='.:/usr/local/php4/lib/php') in /......./modules/coppermine/db_input.php on line 146 |
_________________
../musox.com
Hosted by: Site5.com
musox's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Linux / 1.3.39 / 4.1.22 / 4.4.7 / 9.2.1
|
|
| Back to top |
|
|
Śyama_Dāsa
Developer
Offline
Joined: Apr 19, 2004
Posts: 2048
Location: Dragonfly CMS Tribe
|
Posted: Fri Sep 03, 2004 11:03 am
Post subject: Re: coppermine 1.3 security exploit |
|
change that line to includes/class.phpmailer.php for 8.2b
_________________
AKA Akamu / Read these and your life will be successful | Find a Repair
--
Mods and Professional Support via YIM
Śyama_Dāsa's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
win32 / Apache 1.3.33 / MySQL 4.1.16/PHP 4.4/CPG-CVS ( browsers: Mozilla 1.7.x / IE6 / Opera 8.0)
|
|
| Back to top |
|
|
Jeruvy
Security Team
Offline
Joined: Apr 23, 2004
Posts: 1432
Location: Canada
|
Posted: Fri Sep 03, 2004 1:45 pm
Post subject: Re: coppermine 1.3 security exploit |
|
Ok, folks I have no specifics on this issue. I have no idea how the person was able to change his id.
This patch is speculative at this stage without better details.
_________________
J.
j e r u v y a t y a h o o d o t c o m
Need help? Look here: www.dragonflycms.org/W...d=112.html
Need to chat? Look for me on irc.freenode.net
Jeruvy's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
Ubuntu7.10/Debian3.1 - 2.2.3/1.3.37 - 5.0.38/4.0.27 - 5.2.1/4.4.7 - CVS/9.1.2}
|
|
| Back to top |
|
|
kjcdude
Newbie
Offline
Joined: Aug 27, 2004
Posts: 7
|
Posted: Sat Sep 04, 2004 5:40 am
Post subject: Re: coppermine 1.3 security exploit |
|
After upgrade i tried to upload a picture and recieved the following error.
| Code:: |
Fatal error: Call to undefined function: fix_quotes() in /home/swezey/kyle/dheat/modules/coppermine/db_input.php on line 219 |
-Kyle
kjcdude's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
----
|
|
| Back to top |
|
|
Śyama_Dāsa
Developer
Offline
Joined: Apr 19, 2004
Posts: 2048
Location: Dragonfly CMS Tribe
|
Posted: Sat Sep 04, 2004 5:47 am
Post subject: Re: coppermine 1.3 security exploit |
|
and what version of cpgnuke are you using kcjdude?
_________________
AKA Akamu / Read these and your life will be successful | Find a Repair
--
Mods and Professional Support via YIM
Śyama_Dāsa's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
win32 / Apache 1.3.33 / MySQL 4.1.16/PHP 4.4/CPG-CVS ( browsers: Mozilla 1.7.x / IE6 / Opera 8.0)
|
|
| Back to top |
|
|
Śyama_Dāsa
Developer
Offline
Joined: Apr 19, 2004
Posts: 2048
Location: Dragonfly CMS Tribe
|
Posted: Sat Sep 04, 2004 6:20 am
Post subject: Re: coppermine 1.3 security exploit |
|
I have updated db_input.php to work with 8.2b and 1.3.0 for *nuke
www.cpgnuke.com/cvs/ht....php?g=1.8
_________________
AKA Akamu / Read these and your life will be successful | Find a Repair
--
Mods and Professional Support via YIM
Śyama_Dāsa's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
win32 / Apache 1.3.33 / MySQL 4.1.16/PHP 4.4/CPG-CVS ( browsers: Mozilla 1.7.x / IE6 / Opera 8.0)
|
|
| Back to top |
|
|
kjcdude
Newbie
Offline
Joined: Aug 27, 2004
Posts: 7
|
Posted: Sat Sep 04, 2004 8:29 am
Post subject: Re: coppermine 1.3 security exploit |
|
I am using PHP-Nuke 7.4 Coppermine 1.3.0a .
I will try yours and see if that works.
-Kyle
kjcdude's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS)
----
|
|
| Back to top |
|
|
|
|
Forum FAQ
Log in to check your private messages
Login
Search
