[nerbert]

I just had a member demonstrate a security problem with vB4.2.0, and I'm sure it applies to other versions as well.

I had made the mistake of building an iframe bb code and thought I had it so you couldn't iframe a local page but he demonstrated that you could use URL shortening to get around it and use that to iframe a thread that had an iframe in it and create multiple layers of iframes. That problem is another issue but what really got my attention is he iframed profile.php and used GET values to try to set the user's ignore list to ignore one of the moderators. Well, you have to confirm when you add a user to your ignore list so nothing happened. I checked profile.php and found this, starting on line 449:

PHP Code:

// ############################################################################
// ######################### EDIT BUDDY/IGNORE LISTS ##########################
// ############################################################################
if ($_REQUEST['do'] == 'addlist')
{
    $vbulletin->input->clean_array_gpc('r', array(
        'userid'   => TYPE_UINT,
        'userlist' => TYPE_NOHTML,
    )); 


Since vBulletin's clean_array_gpc('r', -------) method is the equivalent of $_REQUEST it's possible to post a link with GET parameters that will take you to the ignore frame of profile.php and (almost) set your ignore list.

There are other suspicious parts of profile.php at lines 564, 1537, 4707, 222, and elsewhere. Is there any reason to use REQUEST instead of POST for these actions?