Latest posts for the topic "Advanced Guestbook Fixes and Mods"

Advanced Guestbook Fixes and Mods

amber222 — GMT

Fixes for Version 2.3.1 Exploits:
[list]Patch for add.class.php, by Carbonize:
http://proxy2.de/forum/viewtopic.php?t=4144

Workaround Patch for index.php, from Security Focus:
http://www.securityfocus.com/bid/11798/solution/[/list]
Fix for Version 2.2 Exploit, by Carbonize:
http://proxy2.de/forum/viewtopic.php?t=3650

Security Issues, by Trevor:
http://proxy2.de/forum/viewtopic.php?t=3475

Help with Upgrade from 2.2 to 2.3.1:
[list]Guestbook 2.2. to 2.3.1 upgrade script, by Carbonize:
http://proxy2.de/forum/viewtopic.php?t=4010

Discussion on Manual Upgrade:
http://proxy2.de/forum/viewtopic.php?t=3334[/list]Admin Loop (Keeps going back to Login):
http://proxy2.de/forum/viewtopic.php?p=11334&highlight=#11334
http://proxy2.de/forum/viewtopic.php?t=3786

Admin config.inc.php file:
http://proxy2.de/forum/viewtopic.php?t=3654

Password Lock, by Carbonize:
http://proxy2.de/forum/viewtopic.php?p=9621&highlight=#9621

Changing the Admin Password:
http://proxy2.de/forum/viewtopic.php?t=3744

Resetting the Admin Password:
[list]With Carbonize's reset.php file:
http://proxy2.de/forum/viewtopic.php?t=4071

In PhpMyAdmin, by Jam'n:
http://proxy2.de/forum/viewtopic.php?t=2595
http://proxy2.de/forum/viewtopic.php?t=1711
([b]Important: Only follow Jam'n's instructions for resetting the password. Do Not follow others' suggestions to Overwrite the v2.3.1 session.class.php file with the 2.2 version![/b])[/list]Make a backup .sql file of guestbook entries:
[list]Export/Import MySQL Database:
http://proxy2.de/forum/viewtopic.php?t=3580&highlight=sql

Guestbook MySQL database transfer:
http://proxy2.de/forum/viewtopic.php?p=5819&highlight=#5819

Where is the guestbook database?:
http://proxy2.de/forum/viewtopic.php?t=2761&highlight=sql
[/list]Change the Guestbook Picture:
http://proxy2.de/forum/viewtopic.php?t=3827&highlight=picture

How To Change The Drop Down Menu In Advanced Guestbook, by Trevor: http://proxy2.de/forum/viewtopic.php?t=3315

How to change the required fields in Advanced Guestbook, by Trevor:
http://proxy2.de/forum/viewtopic.php?t=2877

Change the Comments Text Color:
http://proxy2.de/forum/viewtopic.php?t=3380
http://proxy2.de/forum/viewtopic.php?t=3219

Image Verification script, by Carbonize (Help reduce Guestbook spam):
http://proxy2.de/forum/viewtopic.php?p=9976
http://www.carbonize.co.uk/verification.zip is the official download for the image verification mod

Quick Mod to have AG 2.3.1 log the IP rather than the hostname, by Carbonize: http://proxy2.de/forum/viewtopic.php?p=10108&highlight=#10108

Admin Panel Logout redirect, by Carbonize:
http://proxy2.de/forum/viewtopic.php?t=3409

"Warning: Cannot modify header information - headers already sent by...":
http://proxy2.de/forum/viewtopic.php?t=3200&highlight=cannot+modify+headers
http://proxy2.de/forum/viewtopic.php?t=3093&highlight=cannot+modify+header

"Warning: fopen(./templates/body.php): failed to open stream: Permission denied in..."
"Warning: fwrite(): supplied argument is not a valid stream resource in..."
"Warning: fclose(): supplied argument is not a valid stream resource in..."
http://proxy2.de/forum/viewtopic.php?t=3580&highlight=fopen

"Fatal error: Cannot instantiate non-existent class: "
http://proxy2.de/forum/viewtopic.php?t=3812

"Warning: fread(): Length parameter must be greater than 0"
http://proxy2.de/forum/viewtopic.php?t=3351&postdays=0&postorder=asc&highlight=fread&start=30

Missing Pictures in Guestbook:
http://proxy2.de/forum/viewtopic.php?t=3628&highlight=missing+pictures

Configuring Smilies in Guestbook:
http://proxy2.de/forum/viewtopic.php?t=3901

Getting Your Logo and Menus In The Guestbook:
[list]Include your header, by Carbonize:
http://proxy2.de/forum/viewtopic.php?t=3460

How can I integrate my guestbook into an existing site?:
http://proxy2.de/forum/viewtopic.php?t=3863

A newbies guide to placing the guestbook in an html page, by fatjack:
http://proxy2.de/forum/viewtopic.php?t=3921

How To Change The Drop Down Menu In Advanced Guestbook, by Trevor: http://proxy2.de/forum/viewtopic.php?t=3315

Adding Guestbook to a Frame:
http://proxy2.de/forum/viewtopic.php?p=9728[/list]Changing the wording ("here you can leave your mark."... etc.):
http://proxy2.de/forum/viewtopic.php?p=9870
http://proxy2.de/forum/viewtopic.php?p=9264

Encrypt visitors email addresses in guestbook (stop email harvesters):
http://proxy2.de/forum/viewtopic.php?t=3778

Making Email a Required field:
http://proxy2.de/forum/viewtopic.php?t=3388&highlight=required+field
http://proxy2.de/forum/viewtopic.php?t=2877

Remove visitors email addresses from guestbook view:
http://proxy2.de/forum/viewtopic.php?p=10856&highlight=#10856

Increase email field size to 60 characters (in templates/form.php):
http://proxy2.de/forum/viewtopic.php?t=3912

Increase homepage field size to 65 characters (in templates/form.php):
http://proxy2.de/forum/viewtopic.php?t=4075

Change the Time in Advanced Guestbook:
http://proxy2.de/forum/viewtopic.php?t=3758

Advanced Guestbook Manual, by Jam'n:
http://www.geocities.com/nathalonia/gbpoll

Explanation of Chmod File Permissions:
http://proxy2.de/forum/viewtopic.php?p=10072&highlight=#10072

How to change File Permissions from the CPanel:
http://proxy2.de/forum/viewtopic.php?p=10713&highlight=#10713

Advanced Guestbook versions for Content Management Systems:
[list]TPK Guestbook 3.1.1 (PhpNuke Version)
See it at: http://www.tp-krefeld.de/modules.php?name=Guestbook
Download it at: http://www.phpnuke-module.de/

Nuke Guestbook 2.0.0 (PhpNuke Version)
http://www.codec-download.com/modules.php?name=Guestbook (English)
http://www.rideo.de/modules.php?cid=18&d_op=viewdownload&min=30&name=Downloads (German)

There are probably more PhpNuke versions out there.

Html code enabled does not appear to pose a risk, but that could be because the admin is using Sentinel (a must-have for PhpNuke Security!).

http://www.3hc.co.uk/studentsupport/ (PhpWebSite Version)
Note: Some CMS versions are based on early versions of Advanced Guestbook (not 2.3.1), so you should investigate re: security. Mods listed here may not work with these versions.[/list]

Anonymous — GMT

Here's the correct link to the post for Carbonize's header instructions:

http://proxy2.de/forum/viewtopic.php?t=3460

Carbonize — GMT

Damn this thread makes it look like I need a life

JTD — GMT

You mean you have a life? Besides redoing most of the GB code.

amber222 — GMT

[quote="Carbonize"]Damn this thread makes it look like I need a life [/quote]

This is your life.

amber222 — GMT

*bump*

Anonymous — GMT

*BUMP*

amber222 — GMT

*bump*

Anonymous — GMT

*BUMP*

Carbonize — GMT

*bump* there it is.

amber222 — GMT

*bump*

amber222 — GMT

*bump*

JTD — GMT

*BUMP*

Anonymous — GMT

*bump*

amber222 — GMT

*bump*

amber222 — GMT

*bump*

amber222 — GMT

*bump*

Carbonize — GMT

Lot of bumps there Amber. You a bit accident prone ?

amber222 — GMT

Inspector Clouseau strikes again.

Carbonize — GMT

*BUMP*

JTD — GMT

[b]*BUMP*[/b]

amber222 — GMT

*bump*

JTD — GMT

*BUMP*

Takara — GMT

Thank you for bumping this. I found the answer to what was driving me crazy and can feel my sanity returning.

Thanks for all the hard work on this!!!

ET — GMT

I was recently hacked by samehelmasry.jeeran.com - guestbook data entirely wiped out but I always keep regular backups.

Hacker came directly to the guestbook from Google with keyword phrase powered by Guestbook 2.2 - just to let you know, I've never had the html enabled - but the gb was still swiped

It is a comfort to be able to check in here to find the solutions. You all are the bestest!!!

Thanks

Carbonize — GMT

I take it you have now patched the login exploit that plagues version 2.2?

Thanks

ET — GMT

Thanks for asking Carbonize.

I have it fixed - and just to be safe, have moved the gb outta the Google path into a new directory and left a mockup version on the old path in the event the individual feels the need to try again.... After going to Google and typing in that keyword phrase, I see that tons and tons of people are hacked - some pretty nasty stuff out there

The only reason I caught it so quickly is because of an error alert that I got when s/he typed in the word "admin.php" incorrectly - The error log picked it up and sent me a notice. Otherwise, I wouldn't have known for a few days (or more) Yeesh!!!

JTD — GMT

[color="purple"]*BUMP* Will someone sticky these damn things please.[/color]

amber222 — GMT

bump

amber222 — GMT

*bump*

amber222 — GMT

*bump*

PandA.nl — GMT

Great post amber222, thanks!!!

And what about:
http://www.securityfocus.com/bid/11798/exploit/
(or did you already mention it?)

There's fix/workaround there too.

I added (guestbook/index.php)[code] $entry = strip_tags($entry);[/code]
after
[code] $entry = (isset($HTTP_POST_VARS["entry"])) ? $HTTP_POST_VARS["entry"] : $entry;[/code](2x) and it seems to work

but probably their fix is better (adding [b]$entry = htmlspecialchars ($entry);[/b]) since I'm not a programmer

BTW: the exploit seems to work on both 2.2. and 2.3.1

JTD — GMT

[quote="PandA.nl"]

BTW: the exploit seems to work on both 2.2. and 2.3.1[/quote]

The sql exploit ony works on 2.3.1 if you have a very outdated version of php.

Anonymous — GMT

[quote="JTD"]The sql exploit ony works on 2.3.1 if you have a very outdated version of php.[/quote]That's not what I read, are you sure we're talking about the same thing?

Carbonize — GMT

the exploit works on Advanced guestbook 2.2 and 2.3, 2.3.1 was released to fix the exploit. It works on some copies of 2.3.1 because the webmasters have replaced the 2.3.1 session.inc.php file with the one from 2.2. It is also alledged that sometimes the addslashes function of older PHP versions fails.

PandA.nl — GMT

Aha, thanks for the explanation!

I noticed a strange thing though. I'm using version 2.3.1 i.c.w. PHP 4.3.10 on two guestbooks, HTML disabled, but several times visitors managed to enter url's (spamming type url's) into the messages they added.

This shouldn't be possible is it? I assume [b]
edit: oops, I suppose the [url]'s are translated to href's by the script of course. Sorry about that

amber222 — GMT

Carbonize, when I read this Security Focus bulletin, it sounds like it is talking about an entirely different exploit, not the one that was in 2.2. It says this exploit is found in 2.3.1, and the suggested patch is for the index.php file, not the session.class.php. But it also says the malicious user "could create a link", perhaps this threat does not exist if html is turned off? Even so, I think if it is really an exploit it should be patched even on those books where html is always turned off.

So, could you please take another look and clarify. It sounds like we also need to patch index.php.

Carbonize — GMT

basically the email you sent is saying that the contents of that particular field are not checked nor altered and so anything can be put in there. With a little HTML or possibly PHP knowledge they could do small things. Remember the field in question is limited to 40 characters.

Carbonize — GMT

Ignore my above post. That so called exploit you sent to me is total crap. It does not exist. I have now emailed the person that submitted it explaining what a moron they are. the guestbook already checks the URL that is submitted using this statement[code]if (htmlspecialchars($this->url) != "$this->url") {
$this->url = '';
}[/code]Which basically says if there is any html characters in the url such as <, > or & then it will not accept the url and removes it from the entry.

PandA.nl — GMT

[quote="Carbonize"][code]if (htmlspecialchars($this->url) != "$this->url") {
$this->url = '';
}[/code]Which basically says if there is any html characters in the url such as <, > or & then it will not accept the url and removes it from the entry.[/quote]

Maybe I don't understand what's happening, but before I did the strip_tags() this exploit:
[quote]http://www.example.com/index.php?entry=[/quote]generated a popup and mysql error, and after I added the strip_tags the popup didn't show anymore (still get a mysql error message). So, allthough it might not be harmfull, it does not look like the html is removed!

Carbonize — GMT

No the exploit exists. I have been in touch with the person that posted it and I was confusing the URL input with the actual URI. I think it was actually recently fixed in 2.3.1 but nothing was said as I noticed soem new lines when I downloaded it agan recently.

JTD — GMT

*BUMP*