Security Hole - HACKERS

17 years 8 months ago #18521 by trebso
Replied by trebso on topic Re:Security Hole - HACKERS
edited profile, log out and then in again no probs.

trebso

Please Log in to join the conversation.

17 years 8 months ago #18531 by GTWillemsen
Replied by GTWillemsen on topic Re:Security Hole - HACKERS
Seems to work,
log in, log out, edit profile, synch users with phpbb, works fine.

edit: (ain't sure if the upgrade is the reason)
I found an error with virtuemart-cart module and viewing user-profile. It shows mysql code, like;

[code:1]Debug: A Session called virtuemart (ID: fef724e2a1b03b91500659f8638323b3) was successfully started![/code:1]
AND
[code:1]12 queries executed

1
SELECT `lft`, `rgt` FROM `joomla_core_acl_aro_groups` WHERE `name`='Public Frontend'2
SELECT g1.group_id, g1.name, COUNT(g2.name) AS level
FROM joomla_core_acl_aro_groups AS g1
INNER JOIN joomla_core_acl_aro_groups AS g2 ON g1.lft BETWEEN g2.lft AND g2.rgt
WHERE g1.lft BETWEEN 3 AND 12
GROUP BY g1.name
ORDER BY g1.lft3
SELECT `lft`, `rgt` FROM `joomla_core_acl_aro_groups` WHERE `name`='Public Backend'4
SELECT g1.group_id, g1.name, COUNT(g2.name) AS level
FROM joomla_core_acl_aro_groups AS g1
INNER JOIN joomla_core_acl_aro_groups AS g2 ON g1.lft BETWEEN g2.lft AND g2.rgt
WHERE g1.lft BETWEEN 13 AND 20
GROUP BY g1.name
ORDER BY g1.lft5
SELECT id, name, email, block, sendEmail, registerDate, lastvisitDate, activation, params
FROM joomla_users
WHERE id = 626
SELECT gid FROM joomla_users WHERE id = '62'7
SELECT g1.group_id, g1.name
FROM joomla_core_acl_aro_groups g1
LEFT JOIN joomla_core_acl_aro_groups g2 ON g2.lft <= g1.lft
WHERE g2.group_id =24
ORDER BY g1.name8
SELECT count(*) FROM joomla_comprofiler WHERE avatarapproved=09
SELECT count(*) FROM joomla_comprofiler_userreports WHERE reportedstatus=010
SELECT count(*) FROM joomla_comprofiler WHERE banned=211
SELECT count(*) FROM joomla_comprofiler WHERE approved=0 AND confirmed=112
SELECT m.*
FROM joomla_menu AS m
WHERE menutype = 'usermenu'
AND published = 1
AND access <= 2
ORDER BY parent, ordering[/code:1]

virtuemart 1.0.6
Joomla! 1.0.10 Stable [ Sundown ]
CBuilder 1.0.1

Post edited by: GTWillemsen, at: 2006/08/10 14:26

Please Log in to join the conversation.

17 years 8 months ago #18570 by pjoomla
Replied by pjoomla on topic Re:Security Hole - HACKERS
These messages normally appear with VirtueMart when you have the Debug Output option turned on (Admin > Configuration > Path & URL tab inside VM).

Do you have that option turned on in VirtueMart?

Please Log in to join the conversation.

17 years 8 months ago #18612 by GTWillemsen
Replied by GTWillemsen on topic Re:Security Hole - HACKERS
No unfortuneatly not.
Was the first thing I thought aswell, but it isn't.

That's why I think it's strange, before upgrading I didn't notice this problem.
And it only happens with CB profile / memberlist.

Please Log in to join the conversation.

17 years 8 months ago #18635 by pjoomla
Replied by pjoomla on topic Re:Security Hole - HACKERS
Can you search all your site's code for the text 'DEBUG' (all caps)?

I searched through all the latest core CB code and could not find it. I am just wondering whether you have a plugin/module/component installed that also defines DEBUG (?).

Post edited by: pjoomla, at: 2006/08/11 18:01

Please Log in to join the conversation.

17 years 8 months ago #18650 by GTWillemsen
Replied by GTWillemsen on topic Re:Security Hole - HACKERS
Sounds logical,
I started a quickscan, but takes too long right now, I'll try later on.

Are you sure: only caps (small and caps don't affect each other?)?

Well, I'll try anyway, but my guess is, that no matter what piece of code should use DEBUG aswell; as long as I haven't turned any debugger on, it still shouldn't appear??

Anyway it's worth a search, so I'll give it a shot.

Thanks so far.

Please Log in to join the conversation.

Moderators: beatnantkrileon
Time to create page: 0.283 seconds

Facebook Twitter LinkedIn