Re: XXS in script Phorum
RaeD Hasadya wrote:
=======================================================================
Script : Script Phorum
Found By : Hasadya Raed
Contact : RaeD@xxxxxxxxxxx
=================================================
exemple:
http://www.site.com/[path]/admin.php?upgradefile=";>**********alert(********.******);</script>
======================
Greetz : Only To Security Focus :)
Is this output coming from some automated security checking script or
what? It looks a lot like it, since the reporter apparently did not look
at the PHP code or wasn't capable of understanding what the PHP code
does. On the 7th of februari, the same kind of report was issued already
by Crack_man <c_r_ck@xxxxxxxxxxx>. The contents of that report were:
=======================================================================
title: XXS in script Phorum
homepage: www.phorum.org
found: 2007-02-25
by: Crack_man
=================================================
exemple:
http://www.site.com/[path]/admin.php?upgradefile=";><script>alert(document.cookie);</script>
======================
greetz : all friend
We replied to that previous report that it was classified as a 100%
bogus report, after investigating the Phorum source code. So why report
it again? Here is the reply that we sent in response to the first report:
--------------
Once again, a false report about Phorum. Please issue an apology ASAP.
1. upgradefiles as a var is only used inside a function. PHP does not take
variables from the global scope for use in functions automatically.
2. 2 lines before that var is echoed, it is set by reading a file name from
disk using the dir() function in PHP.
3. The dir() function reads from a hard coded, relative path on disk and does
not use a variable.
Thanks for trying. If you find a real bug, please let us know. We strive to
make Phorum as bug free as possible.
--------------
This response still stands.
This bug report is a fake.
With kind regards,
Maurice Makaay
Phorum.org developer