Re: XXS in script Phorum

[Maurice Makaay <maurice.makaay () internl net>]

RaeD Hasadya wrote:
> =======================================================================
> Script : Script Phorum
> Found By : Hasadya Raed
> Contact : RaeD () BsdMail Com
> =================================================
> exemple:
> http://www.site.com/[path]/admin.php?upgradefile=";>**********alert(********.******);</script>
> ======================
> Greetz : Only To Security Focus :)
>   
Is this output coming from some automated security checking script or 
what? It looks a lot like it, since the reporter apparently did not look 
at the PHP code or wasn't capable of understanding what the PHP code 
does. On the 7th of februari, the same kind of report was issued already 
by Crack_man <c_r_ck () hotmail com>. The contents of that report were:

=======================================================================
title: XXS in script Phorum

homepage: www.phorum.org
found: 2007-02-25
by: Crack_man

=================================================
exemple:
http://www.site.com/[path]/admin.php?upgradefile=";><script>alert(document.cookie);</script>
======================
greetz : all friend 


We replied to that previous report that it was classified as a 100% 
bogus report, after investigating the Phorum source code. So why report 
it again? Here is the reply that we sent in response to the first report:

--------------

Once again, a false report about Phorum.  Please issue an apology ASAP.

1. upgradefiles as a var is only used inside a function.  PHP does not take variables from the global scope for use in 
functions automatically.

2. 2 lines before that var is echoed, it is set by reading a file name from disk using the dir() function in PHP.

3. The dir() function reads from a hard coded, relative path on disk and does not use a variable.

Thanks for trying.  If you find a real bug, please let us know.  We strive to make Phorum as bug free as possible.
--------------


This response still stands.
This bug report is a fake.


With kind regards,

Maurice Makaay
Phorum.org developer