Ker JeiAr
I just replied to that post. Who knows if they are gonna edit or delete my post, but here is the url, and the quoted post.
http://www.phpbb.com/phpBB/viewtopic.php?p=1019173
Well, here is the issue.
I was told that the important files were protected via session ID's But none of the admin files are. I think being able to place any admin command in an image tag that relies on it's values from GET, and having it execute as soon as an admin views it is a fairly substantial risk. The having an admin exeute SQL queries requires certain circumstances, but is also possible when placed in an img tag. Also, I could very well place an image tag in this post that would delete even the latest announcment released in the announcment form. Obviously I am not gonna do that as it would be a very uncool thing to do, but I just say that to give an example, ya know?
Also, if security in the ACP is not an issue then why is ANY input validation done? It would have saved you guys a load of time to just make it work instead of making it somewhat secure if you really believe security in the ACP is moot.
I am not here to argue with anyone, and I am not here as a security researcher. I am here as a long time phpBB user who has genuine concerns regarding the security of my forum. Thats all. I know that other users see the risk and feel the same way I do also. I do not want this to turn into a debate or a hostile conversation, that helps nothing. I just want to find a solution that makes users who realize the security risk such as myself happy, and feel secure.
Best Regards,
JeiAr
GulfTech Security Research
SubScan 1.2
Replies:
|
2004-03-25 16:48:09
2004-03-24 03:17:41
2004-03-23 11:00:34
2004-03-23 11:16:40
2004-03-23 09:25:26