peter_anderson Posted December 26, 2011 Share Posted December 26, 2011 I'd like to request testing of my forum script. http://www.calicosoft.com/community (Validation: http://www.calicosoft.com/phpfreaks.txt) Thanks in advance. Link to comment https://forums.phpfreaks.com/topic/253852-forum-script-test/ Share on other sites More sharing options...
trq Posted December 27, 2011 Share Posted December 27, 2011 You should really supply a test account for people to use then. Link to comment https://forums.phpfreaks.com/topic/253852-forum-script-test/#findComment-1301545 Share on other sites More sharing options...
peter_anderson Posted December 27, 2011 Author Share Posted December 27, 2011 Username: testee Password: test http://www.calicosoft.com/community/index.php?act=login Link to comment https://forums.phpfreaks.com/topic/253852-forum-script-test/#findComment-1301562 Share on other sites More sharing options...
peter_anderson Posted December 27, 2011 Author Share Posted December 27, 2011 I can't edit my post, but the code is here: https://github.com/calicosoft/CalicoBB Link to comment https://forums.phpfreaks.com/topic/253852-forum-script-test/#findComment-1301568 Share on other sites More sharing options...
Coreye Posted December 28, 2011 Share Posted December 28, 2011 The Topic field is vulnerable to XSS attacks. I have http://www.calicosoft.com/community/forum-2-Testing-Forum.html redirecting to this thread. I registered with real information and I received the below error: Full Path Disclosure: http://www.calicosoft.com/community/index.php?act=sendmessage&to[] Warning: mysqli::real_escape_string() expects parameter 1 to be string, array given in /home/calico/public_html/community/classes/user.class.php on line 565 Open Directory Listing: http://www.calicosoft.com/community/classes/ What forum is this thread under: http://www.calicosoft.com/community/topic-98-TESTING-TOPIC.html? Link to comment https://forums.phpfreaks.com/topic/253852-forum-script-test/#findComment-1301737 Share on other sites More sharing options...
peter_anderson Posted December 28, 2011 Author Share Posted December 28, 2011 The Topic field is vulnerable to XSS attacks. I have http://www.calicosoft.com/community/forum-2-Testing-Forum.html redirecting to this thread. This has been fixed. I registered with real information and I received the below error: The script checks the username, email address and IP address against the stopforumspam API. A couple of users have reported it's been giving that error. I'll have a look at it again. Full Path Disclosure: http://www.calicosoft.com/community/index.php?act=sendmessage&to[] This has been fixed, and a custom error handler has been put in place. Open Directory Listing: http://www.calicosoft.com/community/classes/ This has been fixed. Link to comment https://forums.phpfreaks.com/topic/253852-forum-script-test/#findComment-1301820 Share on other sites More sharing options...
Coreye Posted December 28, 2011 Share Posted December 28, 2011 XSS Vulnerability: If you include code in the subject field it'll execute when replying to a thread. http://www.calicosoft.com/community/index.php?act=reply&tid=104 Slashes are stripped from the subject and can result in blank subjects. The redirect on thread creation will also error. Link to comment https://forums.phpfreaks.com/topic/253852-forum-script-test/#findComment-1302014 Share on other sites More sharing options...
peter_anderson Posted December 28, 2011 Author Share Posted December 28, 2011 Both issues fixed. Link to comment https://forums.phpfreaks.com/topic/253852-forum-script-test/#findComment-1302017 Share on other sites More sharing options...
Coreye Posted December 28, 2011 Share Posted December 28, 2011 Long subjects cause a "Forbidden" permission error. Link to comment https://forums.phpfreaks.com/topic/253852-forum-script-test/#findComment-1302020 Share on other sites More sharing options...
peter_anderson Posted December 28, 2011 Author Share Posted December 28, 2011 Also fixed. Subjects are also prevented from being too long without spaces. Link to comment https://forums.phpfreaks.com/topic/253852-forum-script-test/#findComment-1302022 Share on other sites More sharing options...
Coreye Posted December 29, 2011 Share Posted December 29, 2011 XSS Vulnerability: http://www.calicosoft.com/community/topic-116-ou.html The "Edit" field is vulnerable to XSS attacks. XSS Vulnerability: http://www.calicosoft.com/community/downloads-category-4-CalicoKB-Themes-amp-Modifications.html The "Title" field is vulnerable to XSS attacks. When you use the "YouTube" BBCode the video doesn't show up and "0" is placed in the content box. If the subject has "Y" in it the letter is removed. You get the below error when PMing people who DO exist. Error: The user you are trying to private message could not be found. Please check that this user exists and you have spelt their username correctly Link to comment https://forums.phpfreaks.com/topic/253852-forum-script-test/#findComment-1302033 Share on other sites More sharing options...
peter_anderson Posted December 29, 2011 Author Share Posted December 29, 2011 Fixed the two XSS problems (and found a couple more which have been fixed). The Youtube JS has also been fixed, I was using & rather than + to join the strings. I could no replicate the Youtube problem - http://www.calicosoft.com/community/index.php?post=216&tid=118 If you were trying to PM CalicoSoft, that error should occur as I had disabled the PM system. The error text will be changed. Link to comment https://forums.phpfreaks.com/topic/253852-forum-script-test/#findComment-1302148 Share on other sites More sharing options...
Coreye Posted December 29, 2011 Share Posted December 29, 2011 The script checks the username, email address and IP address against the stopforumspam API. A couple of users have reported it's been giving that error. I'll have a look at it again. Was this looked into? I'm now getting: Error: Sorry, registration cannot proceed. Your details match known spammers the StopForumSpam database. Your username appears in this database. Please try a different username or email. I tried to register with "Corey" as my username. Link to comment https://forums.phpfreaks.com/topic/253852-forum-script-test/#findComment-1302373 Share on other sites More sharing options...
peter_anderson Posted December 29, 2011 Author Share Posted December 29, 2011 Maybe the system should only check email addresses. I'll get that changed. Here's the API result, BTW: http://stopforumspam.com/api?username=Corey Link to comment https://forums.phpfreaks.com/topic/253852-forum-script-test/#findComment-1302377 Share on other sites More sharing options...
Recommended Posts