GetSimple Support Forum › GetSimple › Announcements v
security report 3.1.2

Thread Rating:
  • 1 Vote(s) - 5 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Thread Modes
security report 3.1.2
n00dles101 Offline
Administrator
*******
Posts: 1,108
Threads: 70
Joined: Aug 2009
#22
2013-01-12, 01:05:43
Agreed this really is no threat to a standard install of GS312

Code as published will not work on a standard install of GetSimple 3.1.2

I have been able to get something working but I've had to delete the authorization.xml file and turn off GSNOCSRF in gsconfig and add the missing cookies and POST variables.

Author of the exploit also has some changes made to php.ini on his local build to turn off some security settings to help with his security testing. Quote: 'for example display_error or register_globals (etc,etc) set to 'On' (to get more errors durning pentest/src audit).'

AS for executing a command I've been unable to do this either. I have been able to include a rouge PHP file, but i'd have to have access to your server first to be able to do this.

So all in all I'm unconvinced that this 'exploit' poses any threat to GetSimple.
My Github Repos: Github
Website: DigiMute
Website Find
Reply


Messages In This Thread
security report 3.1.2 - by shawn_a - 2013-01-10, 04:30:06
RE: SECURITY EXPLOIT 3.1.2 - by n00dles101 - 2013-01-10, 06:34:09
RE: SECURITY EXPLOIT 3.1.2 - by shawn_a - 2013-01-10, 06:37:54
RE: SECURITY EXPLOIT 3.1.2 - by shawn_a - 2013-01-10, 07:01:33
RE: SECURITY EXPLOIT 3.1.2 - by shawn_a - 2013-01-10, 08:15:49
RE: SECURITY EXPLOIT 3.1.2 - by shawn_a - 2013-01-10, 09:56:34
RE: SECURITY EXPLOIT 3.1.2 - by Connie - 2013-01-10, 17:27:27
RE: SECURITY EXPLOIT 3.1.2 - by D.O. - 2013-01-10, 18:08:20
RE: SECURITY EXPLOIT 3.1.2 - by HauntIT - 2013-01-10, 19:17:26
RE: SECURITY EXPLOIT 3.1.2 - by D.O. - 2013-01-10, 20:11:07
RE: SECURITY EXPLOIT 3.1.2 - by HauntIT - 2013-01-10, 21:04:24
RE: SECURITY EXPLOIT 3.1.2 - by Connie - 2013-01-10, 22:01:31
RE: SECURITY EXPLOIT 3.1.2 - by HauntIT - 2013-01-10, 22:48:39
RE: SECURITY EXPLOIT 3.1.2 - by shawn_a - 2013-01-11, 00:00:50
RE: SECURITY EXPLOIT 3.1.2 - by shawn_a - 2013-01-11, 00:21:51
RE: SECURITY EXPLOIT 3.1.2 - by HauntIT - 2013-01-11, 01:06:06
RE: SECURITY EXPLOIT 3.1.2 - by shawn_a - 2013-01-11, 01:14:43
RE: SECURITY EXPLOIT 3.1.2 - by shawn_a - 2013-01-11, 01:38:58
RE: security report 3.1.2 - by shawn_a - 2013-01-11, 06:55:04
RE: security report 3.1.2 - by HauntIT - 2013-01-11, 17:40:42
RE: security report 3.1.2 - by shawn_a - 2013-01-11, 23:10:14
RE: security report 3.1.2 - by n00dles101 - 2013-01-12, 01:05:43
RE: security report 3.1.2 - by shawn_a - 2013-01-12, 02:03:11
RE: security report 3.1.2 - by D.O. - 2013-01-17, 18:55:34
RE: security report 3.1.2 - by n00dles101 - 2013-01-17, 19:39:31
RE: security report 3.1.2 - by D.O. - 2013-01-17, 21:08:04



Users browsing this thread: 1 Guest(s)