Date: Mon, 31 Dec 2012 16:21:23 +0100 From: Emanuele <emanuele45@...il.com> To: Moritz Naumann <oss-security@...itz-naumann.com> CC: oss-security@...ts.openwall.com, henri@...v.fi, security@...plemachines.org, irist.ir@...il.com Subject: Re: Dispute CVE-2012-5903 SMF index.php scheduled-parameter XSS Hello, my name is Emanuele, and I'm one of the current SMF developers. Moritz Naumann wrote: > On 31.12.2012 11:42 Henri Salo wrote: > [..] > >> Until someone provides a working PoC I dispute this issue. SMF hasn't replied to my emails about this. I'm sorry nobody answered. >> Please note there is several comments in forums about this too. >> >> > [..] > >> It's not a security vulnerability if attacker already has administrator access to the application. Should we REJECT CVE-2012-5903? >> > Based on the authors' description it would seem more likely that the > attack would use social engineering to trick the legitimate forum admin > into accessing this URL with a payload in it, which would then trigger > in his browser and disclose the admins' session cookie to an attacker by > means of cross site scripting. Like you, I don't see how the value > passed to the "scheduled" parameter would be echoed out, though. > As I wrote in my post the scheduled parameter doesn't output anything on the screen. It is just used to decide what action should be taken. Relevant code involved: https://github.com/SimpleMachines/SMF2.1/blob/release-2.1/index.php#L81 https://github.com/SimpleMachines/SMF2.1/blob/release-2.1/Sources/ScheduledTasks.php#L27 https://github.com/SimpleMachines/SMF2.1/blob/release-2.1/Sources/ScheduledTasks.php#L132 These are the only instances of "scheduled" in the entire codebase (the code is from the future SMF 2.1 version, but it didn't change from 2.0). Kindred answer (comment ) is not relevant. He was probably referring to another bug we fixed with the latest patch (2.0.3). 1: http://www.simplemachines.org/community/index.php?topic=491516.msg3445272#msg344527 > While it doesn't directly impact treatment of this latest report, I'd > like to point out that there has been a previous report by the same > author on the same product back in october, which I was also unable to > reproduce: > > [...] > http://packetstormsecurity.com/files/117618/SMF-2.0.2-Cross-Site-Scripting.html > And again the "view" is only used to decide the action, but it is not used to produce any output. Thank you for the email. Best regards, Emanuele
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.