Messages posted by: becki

well ... also went on a search on google.com a while ago and searched for guestbooks open for the exploit !
then i also found some version 2.3.1 guestbooks runing PHP version up to 4.3.7 which were still open for the exploit !!!

also posted a bug report on http://bugs.php.net/bug.php?id=28906 but so far this report is still OPEN !! for weeks now

so .. protect your admin.php file with .htaccess file ..... or rename it ... not a good solution .... or install the patch which can be found at http://www.beckspaced.com/gb_fix/index.php

in the meantime .. have fun & enjoy life to its best

becki

so what am I trying to say ?? everything quite easy

first go and read all the stuff written at http://www.beckspaced.com/gb_fix/index.php ! there's all the info you should need

then ... you don't need to double protect your guestbook ! just decide for which you want to go >

1.) protect via .htaccess file
2.) install the patch !

either one of those should work fine

about the version i'm not sure

i just downloaded the latest version from http://proxy2.de and therefore i suppose it's version 2.3.1 !!

as i don't have any older version like 2.2 i don't recmommend to install the patch on a 2.2 version ! better upgrade to 2.3.1 and then install the patch !

or pass me the old 2.2. version so i can have a look on how to secure this thing

hope this helps
becki

hello,

hmh ... i'm not sure if the version 2.3.1 isn't open for the exploit with the empty username and the password ') OR ('a' = 'a

well ... i mean even http://proxy2.de/guestbook/admin.php is secured with a .htaccess file !! there must be a reason for it, isn't it ??

i could gain access on SOME guestbooks on the internet runing the version 2.3.1 .... but this wasn't possible EVERY time ! sometimes the exploit just worked and other times it doesn't !! strange behaviour

anyway ... developed a security patch for this exploit a couple of days ago and just thought it might be worth posting here and let other people know about

sooo ...check out this link => http://www.beckspaced.com/gb_fix/index.php

hope this helps a bit

all the best
becki

hello rudolfo

i exactly understand what you mean ! having a guestbook runing which is open for intruders is a very bad thing. and the internet is full with strange guys .. believe me

anyway ... i also discovered some possible security hack with the gusetbook version 2.3.1 ! but first i have to say the code is written fine and the error doesn't seem to be in there. guestbook code is okay !

but as far as i have studied there seems to be a problem with PHP and this get_magic_quotes_gpc() function !! i already posted a bug report on http://bugs.php.net but so far no answer ... the problem isn't solved yet

my 2.3.1 version guestbooks for my customers are also OPEN for intruders ! therefore i developed a SECURITY FIX PATCH for the 2.3.1 version and posted all the stuff at my website at http://www.beckspaced.com/gb_fix/index.php

why don't you go there and have a look at that stuff

all information is written there ..hope it helps a bit to fix your guestbook :o

also wrote an email to http://proxy2.de but so far haven't received any answer, yet

however ... hope this helps !

all the best
becki