Modification Security

[|Jordan|]

With the recent SQL Injection issues present in a lot of plugins, it would be great if there were a way for VB.org to automate modification security audits (on attaching files to thread), this way it would save you the time of manually auditing and us getting our forums hacked.

[Disasterpiece]

There is a plugin out there, implementing cracker tracker, which is a php-allround-security solution.
https://vborg.vbsupport.ru/showthread.php?t=110030

I just checked the code, it should work with all current vbulletin versions as well, since it doesn't rely much on vbulletin structures. You might want to check that out if you're that concerned.

[BirdOPrey5]

Originally Posted by |Jordan|

With the recent SQL Injection issues present in a lot of plugins...

I wasn't aware it was a lot? I thought it was one.

[Disasterpiece]

I think I'm gonna start a security plugin tomorrow. Can't believe there isn't something around here yet.

[Lynne]

Automated modification security? I can't even imagine writing the script to do that. Besides that, we like mods to be uploaded as zip files so all the files are together in one place.

And, as Joe stated, we've had one plugin lately that had a security problem. The last time we had something quarantined for a security reason was last June.

[|Jordan|]

Originally Posted by Lynne

Automated modification security? I can't even imagine writing the script to do that. Besides that, we like mods to be uploaded as zip files so all the files are together in one place.

And, as Joe stated, we've had one plugin lately that had a security problem. The last time we had something quarantined for a security reason was last June.

Modification security could just unzip the attachment, analyze every line and check if they're SQL statements are escaped properly.

According to the vb.com thread about the latest SQL injection issues, a ton of plugins are currently susceptible, but no one really knows until they get hacked. A few plugins that were confirmed to be insecure (some got fixed) were "Advanced Rules" and "Admin Log In As User".