Top_Sites Module warning

Major Joined: Jan 13, 2003 Posts: 892

Top_Sites is a nice very basic mod of weblinks provided by PHP-Nuke Algerie
http://phpnuke-dz.com/

There is a flaw in this module that allows any logged in user to delete any "Top Site" they choose simply by entering this url with the lid# of the "Top Site" they wish to delete.
top.html_Site&op=dellink&lid=1

Notified PHP-Nuke Algerie today.

Maybe this was sposed to be a future feature Razz

Major Joined: Jan 13, 2003 Posts: 892

Simple temp patch

modules/Top_Sites/index.php
Find:

Code:

function dellink($lid) {
global $prefix, $dbi, $user;
if (is_user($user)) {

Replace with

Code:

function dellink($lid) {
global $prefix, $dbi, $admin;
if (is_admin($admin)) {

Nuke Cops Founder Joined: Nov 14, 2002 Posts: 5939

Ouch, that was sloppy coding on their part. Nice catch. Consider posting that at nuke's news?

Major Joined: Jan 13, 2003 Posts: 892

Author released an "Official Patch" here:
http://phpnuke-dz.com/modules.php?name=News&file=article&sid=31
I didn't get a chance to look at it but the dell function was rewritten I'll test it out again this evening.

~Peter

Major Joined: Jan 13, 2003 Posts: 892

New bug with the Top_Sites 1.0.1 post previous patch.

This is more serious. This allows logged in user to pass java script to the admin when admin goes to check new link submissions.

Expoit:

Code:

<SCRIPT>alert("Filter This!");</SCRIPT dummy_flag = true>

Notified author expect new patch or version release correcting this bug in the near future. Though author has not replied directly regarding any bug reports submitted.

Note* This does not effect the web links module which properly squashes this kind of simple script!

~Peter

Nuke Cops Founder Joined: Nov 14, 2002 Posts: 5939

Ah, I understand now.

Major Joined: Jan 13, 2003 Posts: 892

Today sid from http://phpnuke-dz.com/ gave me the opportunity to preview and test Top Site 1.2 beta. I must say he has made many enhancements to the module and its looking very good. I submitted some XSS patches to him today and would expect the next release to be much safer, stable, and functional the the initial release. He's put a lot into this next release and I'm looking forward to its public release.

~Peter