01-19-2015, 07:07 AM
|
|
|
|
Join Date: Sep 2011
Posts: 477
Благодарил(а): 0 раз(а)
Поблагодарили:
0 раз(а) в 0 сообщениях
|
|
Quote:
Originally Posted by TiKu
We use vBSSO to connect vBulletin 4.2 with Wordpress 4.0 and Mediawiki 1.23. One of our users has the vBulletin user name "T?sti's Welle". I don't know whether Wordpress can deal with this user name, as the user is not in a user group that has access to our Wordpress dashboard. But Mediawiki has problems with this name - the user does not get logged in to Mediawiki. And worse: According to the vBSSO logs the system runs into a SQL error, that seems to occur due to missing escaping of the apostroph in the user name. This seems like a security hole to me, as it might allow SQL injection!
Here are the important lines from the log file (I've removed some parts to protect our forum):
Code:
Sun Jan 18 19:08:18 2015,584 [23526] DEBUG localFileLogger - Platform request JSON: {"email":"xyz@mydomain.com","username":"T\u00e4sti's Welle","usergroup":"2","e":6,"lid":"547a124e343fb2.23578572","d":"http:\/\/www.mydomain.com\/vbulletin\/admincp\/user.php?do=edit&u=98985"}
Sun Jan 18 19:08:18 2015,584 [23526] DEBUG localFileLogger - Platform request encrypted JSON: HHqgd6uMZZyW2mJIZ63QhGgJPoi//Gm4a1+Fp5a/49YTXbCsUhbeidQWpRqhfaQqfixmAr/iG1lKUJZfMLV85UKZdCgG94Wm5TuI9tqYzsMLBy2wqqVcSRd8ErbXB314PF4bhT11cXpNp3X9lrp8fSNHA++0SvzZZMfrhKwF+fwFVgXMOhcLohxTQ0tFzuLUazAIPVFU0dsRMlhRVr2YRfH8pOZcL24kDCFAyzU7pNc58c5AKoS7E1DCFm7Gah19kRXadS1yT4MoXhHOqKCE9Q==
Sun Jan 18 19:08:18 2015,584 [23526] DEBUG localFileLogger - Platform request urlencoded/encrypted JSON: HHqgd6uMZZyW2mJIZ63QhGgJPoi%2F%2FGm4a1%2BFp5a%2F49YTXbCsUhbeidQWpRqhfaQqfixmAr%2FiG1lKUJZfMLV85UKZdCgG94Wm5TuI9tqYzsMLBy2wqqVcSRd8ErbXB314PF4bhT11cXpNp3X9lrp8fSNHA%2B%2B0SvzZZMfrhKwF%2BfwFVgXMOhcLohxTQ0tFzuLUazAIPVFU0dsRMlhRVr2YRfH8pOZcL24kDCFAyzU7pNc58c5AKoS7E1DCFm7Gah19kRXadS1yT4MoXhHOqKCE9Q%3D%3D
Sun Jan 18 19:08:18 2015,642 [23526] DEBUG localFileLogger - Communication: Platform returned http status code: 200
Sun Jan 18 19:08:18 2015,642 [23526] DEBUG localFileLogger - Communication: Platform returned error:
Sun Jan 18 19:08:18 2015,642 [23526] DEBUG localFileLogger - Communication: Platform returned response: <!DOCTYPE HTML>
<html>
<head>
<title>MediaWiki API</title>
</head>
<body>
<pre>
<span style="color:blue;"><?xml version="1.0"?></span>
<span style="color:blue;"><api></span>
<span style="color:blue;"><error code="internal_api_error_DBQueryError" info="Database query error" xml:space="preserve"></span>
#0 /apache/dc/htdocs/wiki/includes/db/Database.php(1123): DatabaseBase->reportQueryError('Table './dcwiki...', 145, 'INSERT IGNORE I...', 'User::removeGro...', false)
#1 /apache/dc/htdocs/wiki/includes/db/Database.php(1920): DatabaseBase->query('INSERT IGNORE I...', 'User::removeGro...')
#2 /apache/dc/htdocs/wiki/includes/User.php(2968): DatabaseBase->insert('user_former_gro...', Array, 'User::removeGro...', Array)
#3 /apache/dc/htdocs/wiki/extensions/vbsso/includes/api.php(63): User->removeGroup('bot')
#4 [internal function]: vbsso_listener_register(Array)
#5 /apache/dc/htdocs/wiki/extensions/vbsso/includes/sharedapi.php(349): call_user_func('vbsso_listener_...', Array)
#6 /apache/dc/htdocs/wiki/extensions/vbsso/apivbsso.php(35): sharedapi_data_handler(9, '1.23.5', '1.0.1', '316050855963126...', Array)
#7 /apache/dc/htdocs/wiki/includes/api/ApiMain.php(913): vbsso->execute()
#8 /apache/dc/htdocs/wiki/includes/api/ApiMain.php(363): ApiMain->executeAction()
#9 /apache/dc/htdocs/wiki/includes/api/ApiMain.php(334): ApiMain->executeActionWithErrorHandling()
#10 /apache/dc/htdocs/wiki/api.php(85): ApiMain->execute()
#11 {main}
<span style="color:blue;"></error></span>
<span style="color:blue;"></api></span>
</pre>
</body>
</html>
<script>if(window.mw){
mw.config.set({"wgBackendResponseTime":54});
}</script>
Sun Jan 18 19:08:18 2015,642 [23526] ERROR localFileLogger - Communication: Unable to accept response:
Sun Jan 18 19:08:18 2015,642 [23526] ERROR localFileLogger - Wrong Shared Password
There is another user with the same problem, but another kind of apostroph in his name (? instead of ').
So if this is a vulnerability, can it please be fixed?
Is there a way that vBSSO converts user names on the fly so that Mediawiki will accept them? For instance any apostroph could be removed or replaced with a dash, followed by the apostroph's hex code.
Regards
TiKu |
Could you please contact support team http://vbsso.com/report-an-issue/ describing the steps you use to reproduce your case on your website.
Thank you,
|
More Information