WonderCMS community

igorkov

For fix hook problem in file editInplace.php, change:
<?php if(isset($_REQUEST['hook']))include($_REQUEST['hook']); ?>
to:
<?php session_start();if(is_loggedin() and isset($_REQUEST['hook'])){include($_REQUEST['hook']);}else{echo"ERROR";}
function is_loggedin(){if(isset($_SESSION['l'])) return ...

igorkov

Hice...

Hard fix this problems, after getting page name:

Code: Select all

$rp = isset($_REQUEST['page']) ? $_REQUEST['page'] : '';

Add cuts all symbols, except A-Z, a-z and '-':

Code: Select all

$rp = preg_replace('/[^a-zA-Z0-9-]/', '', $rp);

Example:
http://igorkov.org/%3Cscript%3Ealert%28 ... /script%3E

igorkov

And next link:

Code: Select all

http://wondercms.com/labs/06beta/js/editInplace.php?hook=../files/password

Also must be fixed.

igorkov

Sample:
http://wondercms.com/labs/06beta/password

This is not good, because md5 not strong algorithm, and can be brutеforce.

For fix it (and other system pages):

$denypages = array("copyright", "description", "keywords", "menu", "password", "subside", "themeSelect", "title");

And before ...

WonderCMS community

Search found 4 matches

Re: Fix password md5 show

Re: Security Vulnerabilities

Re: Fix password md5 show

Fix password md5 show