Security hole in attachment downloads for points.

Personally I tend to copy and paste links from the attachment manager into the text editor to link attachment downloads and i've come across the following issue.

Links in the attachment manager after upload are structured like the example below.

http://yoursite/forum/attachment.php?attachmentid=137&stc=1&d=1137783349

An equivalent link without stc=1 will substract the points or show the purchase attachment template.

If you use the links with STC=1, they will be available for free...anybody who knows this can download anything for free, no matter the amount of points needed.

I believe the issue can be easily fixed, but I'm not a php expert.
If i'm not mistaken the file to be fixed is plugins/vbplaza_attachment_start.php.

I have a shop built around vbplaza and would love to have this fixed since we are about to launch in a few days.

[Bernd]

I am a complete php noob, so no
So just replace post with get in vbplaza_attachment_start.php, and the issue could possibly be solved?

[Quarterbore]

Just be careful but yes, the difference between a GET and POST is that teh GET sends the variable name in the url while with a POST the variable and the value is hidden.

Now, I can't promise this will work as there are a great many things about vBulletin that I need to learn but that is certainly the basic PHP code difference between a GET and POST!

[Bernd]

Ok, thanks for explaining. I'll try that one and post the results.

				// check if the user has already OK'd the points removal
				if ($vbulletin->options['vbbux_attachconfirmpage'] && ($_GET['download'] != '1'))

is the only place in vbplaza_attachment_start.php where "POST" is located. Doesn't seem like that's causing the issue though. To be certain i have replaced it with "GET", but a link with STC=1 will still download without showing the vbplaza download attachment template or substracting the points.

Could there be a plugin hooked into attachment somewhere that contains POST? Still seems to be there's something wrong in the above mentioned php.

[Replicators]

I hope this exploit gets fixed, cause my site relies heavily on the attachment download system.

[fly]

This is odd. Where has CMX been?

[Bernd]

Don't know, haven't seen him answer any questions for about 1.5 weeks.
I've sent him a private message. Personally willing to hire a coder to fix the issue, so If I don't get a reply from cmx within two weeks I'll post the fix here once a coder has accepted the job.

[fly]

Maybe we should all read the 17 stickys in this forum... *hint*hint* LOL

[Quarterbore]

Originally Posted by Bernd

Ok, thanks for explaining. I'll try that one and post the results.

				// check if the user has already OK'd the points removal
				if ($vbulletin->options['vbbux_attachconfirmpage'] && ($_GET['download'] != '1'))

is the only place in vbplaza_attachment_start.php where "POST" is located. Doesn't seem like that's causing the issue though. To be certain i have replaced it with "GET", but a link with STC=1 will still download without showing the vbplaza download attachment template or substracting the points.

Could there be a plugin hooked into attachment somewhere that contains POST? Still seems to be there's something wrong in the above mentioned php.

I am in the middle of a major progaming effort myself so I can't take the time to debug this but I am confident that the line of code posted above is NOT the code that is the problem ...

I believe you will find the problem somewhere in the pluggin system or one of the hooks and that the code you will be looking for is more like:

<form action=somescript.php method=get ..........>

That code could be just about anywhere however. As I said, I would look in the plugin and hooks, then I would look at the php files for the script...

The developer should be able to advise in seconds where the code is that does this update however...

Good luck and if I find the time I can try to work on it but right now I have a huge project of my own that is taking all my free time and this "Security Gap" does not affect me and my sites at this time...

[Bernd]

Originally Posted by flypaper

Maybe we should all read the 17 stickys in this forum... *hint*hint* LOL

Whoops

"I'm currently involved in a business matter that is 'away from home'."
Says he'll be back around the second to answer posts. Our site is probably going live in about three weeks, so not in that much of a hurry.

@ Quarterbore

Thanks for the extra info..i'll see if i can find some attachment hooks that are relevant in this case.

[Gio~Logist]

		if ($vbulletin->options['vbbux_pointsforattachments'] && ($_GET['stc'] != 1))

Naturally, this can be removed my reply removing the && ($_GET['stc'] != 1). However, there has to be a reason as to why that's there. Are you sure that this "exploit" is the same for even regular members? Has anyone tried setting up a test account on their site to see?