[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAKws9z0qx_7spQTw9Z3vrV1hRa8so=G-1T7eegnLuMzTp0H59Q@mail.gmail.com>
Date: Fri, 10 Jun 2016 13:56:14 -0400
From: Scott Arciszewski <scott@...agonie.com>
To: oss-security@...ts.openwall.com
Subject: Simple Machines Forums - PHP Object Injection
I reported the following PHP Object Injection vulnerabilities to the SMF
development team on March 9, 2016:
https://github.com/SimpleMachines/SMF2.1/blob/404fd5347951652624dfb72304ee38fcab98378f/Sources/Packages.php#L863-L873
https://github.com/SimpleMachines/SMF2.1/blob/19ee85ff8761b792ea3e9ed630a947f45f93ee68/Sources/LogInOut.php#L125-L129
In the first case, you can achieve PHP Object Injection by sending
themechanges[]=serialized+object+here in the POST data of an HTTP request.
It looks like someone had attempted to find+replace all the obvious PHP
Object Injection issues (i.e. unserialize($_POST['foo'])) at some point,
but they didn't look for variables directly derived from user input.
(foreach ($_POST['foo'] as $bar)).
I've sent follow-up emails to the development team but was never notified
of any progress towards fixing it.
The first one appears to have been fixed in the release-2.1 branch, but the
other one still exists.
https://github.com/SimpleMachines/SMF2.1/blob/release-2.1/Sources/Packages.php#L872-L882
is fixed
https://github.com/SimpleMachines/SMF2.1/blob/release-2.1/Sources/LogInOut.php#L125-L129
is unfixed
That's all from me.
Scott Arciszewski
Chief Development Officer
Paragon Initiative Enterprises <https://paragonie.com>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
