vb.org Archive - View Single Post - Add-On Releases - vBulletin-Glossary

Keyser Soze · #49 08-17-2008, 02:15 PM

Important Security Issue: Googlebot is able to create glossary-entries!
I have noticed that "unregistered" users with the IPs 66.249.71.26 and 66.249.71.25 have been able to create numerous new Glossary entries. These entries don't have a name and no description, but they do exist in my database.
No I am asking myself:
1.) Why is it possible that unregisterd users are able to create new entries and insert data into mysql, even if I disallowed the guest-usergroup to create new entries?
2.) Why is it possible to create new entries with an empty title and description, no matter if we are talking about registered or unregistered users?

As long as these questions are not answered, I would advise everyone who is reading this to disable this addon immediately and to no longer make it avaible for download here as long as this security issue is not fixed.

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01181 seconds Memory Usage 1,759KB Queries Executed 11 (?)
More Information
Template Usage: (1)SHOWTHREAD_SHOWPOST (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_box (1)post_thanks_button (1)post_thanks_javascript (1)post_thanks_navbar_search (1)post_thanks_postbit_info (1)postbit (1)postbit_onlinestatus (1)postbit_wrapper (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit reputationlevel showthread	Included Files: ./showpost.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/functions_bigthree.php ./includes/class_postbit.php ./includes/class_bbcode.php ./includes/functions_reputation.php ./includes/functions_post_thanks.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_postinfo_query fetch_postinfo fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete showpost_start bbcode_fetch_tags bbcode_create postbit_factory showpost_post postbit_display_start post_thanks_function_post_thanks_off_start post_thanks_function_post_thanks_off_end post_thanks_function_fetch_thanks_start post_thanks_function_fetch_thanks_end post_thanks_function_thanked_already_start post_thanks_function_thanked_already_end fetch_musername postbit_imicons bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete postbit_display_complete post_thanks_function_can_thank_this_post_start showpost_complete
Messages: