phpBB "postorder" Parameter Cross Site Scripting

Support Mod Joined: Jul 17, 2003 Posts: 12

phpBB "postorder" Parameter Cross Site Scripting Vulnerability

I don't know how much this affects PHP-Nuke, since the GET array is checked against "<script>" strings, but could somebody commend on this?

Posted: Mon Mar 01, 2004 7:02 am

The fix they mention is not nice.
This is better change in "modules/Forums/viewtopic.php"

Code:

if ( !empty($HTTP_POST_VARS['postorder']) || !empty($HTTP_GET_VARS['postorder']) )
{
$post_order = (!empty($HTTP_POST_VARS['postorder'])) ? $HTTP_POST_VARS['postorder'] : $HTTP_GET_VARS['postorder'];
$post_time_order = ($post_order == "asc") ? "ASC" : "DESC";

into

Code:

if ( !empty($HTTP_POST_VARS['postorder']) || !empty($HTTP_GET_VARS['postorder']) )
{
$post_order = (!empty($HTTP_POST_VARS['postorder'])) ? $HTTP_POST_VARS['postorder'] : $HTTP_GET_VARS['postorder'];
$post_order = substr($post_order, 0, 3);
$post_time_order = ($post_order == "asc") ? "ASC" : "DESC";

Posted: Mon Mar 01, 2004 7:31 am

I would guess valid sort orders would be ascending and descending, if that is the case then the following would do:

In viewtopic.php find:

Code:

//
// Decide how to order the post display
//
if ( !empty($HTTP_POST_VARS['postorder']) || !empty($HTTP_GET_VARS['postorder']) )
{
$post_order = (!empty($HTTP_POST_VARS['postorder'])) ? $HTTP_POST_VARS['postorder'] : $HTTP_GET_VARS['postorder'];

After add:

Code:

if (!eregi("^((asc)|(desc))$",$post_order) )
{
message_die(GENERAL_ERROR, 'Selected post order is not valid');
}

To test it view any topic and at the end of the url add:

Code:

&postorder=chatserv

Not the result kiddies would expect.