Security update [MUST HAVE]

Dear customers,

We have detected a few Vulnerabilities in the script and strongly recommend applying the patch below.
If you see the code below already in place it means that we added the code for you using your ftp logins.


To fix the vulnerability you should add the code that is highlighted in bold green.
(!) Before you change the files, back up the files to be modified.


/libs/upload/upload.php

Code:

---

Only registered members can view the code.

---

/files/.htaccess

Code:

---

Only registered members can view the code.

---

/tmp/upload/.htaccess
Updated: the file must contain only the code

Code:

---

Only registered members can view the code.

---

/.htaccess

Code:

---

Only registered members can view the code.

---

/libs/system.lib.php

Code:

---

Only registered members can view the code.

---

The other minor vulnerabilities, which will not affect stability and security of your site, will be posted later in this thread.

Possible SQL Injection and FIX for it
rlAccount.class.php
rlListings.class.php
rlCategories.class.php
rlSearch.class.php
rlPlan.class.php

Subscribe to this thread and keep up with the latest updates.

I'll give it a try.

Thanks,
Nguyen

Done
Thank you

Patrice

Please advise patch update for version 4.0.1

rosegarden,

This is patch for Flynax v4.X

For Version 4.0.01, the following file is slightly different on code starting from "function handle_file_upload ..."
I do not want to insert the coding here but you can check my ticket #OXO-741609

/libs/upload/upload.php

Hope to hear your answer soon as I want to do the patch now

hm.. OK
This is for Flynax v4.0.1

/libs/upload/upload.php

Code:

---

Only registered members can view the code.

---

so are these changes added to full version, if I want to do a reinstall or do I still have to add it manually?

Yes, these changes have been added to the version for download.

Quote:

---

Originally Posted by Exe

/tmp/upload/.htaccess

Code:

---

Only registered members can view the code.

---

---

The file here (/tmp/upload/.htaccess) has (?) this already:

Code:

---

Only registered members can view the code.

---

I think this is the same, or not?

Thank you!

Quote:

---

Originally Posted by Matthias Ficht

I think this is the same, or not?

---

Yes, you are right

My website was already compromised. 32 domains was hacked.

Hi Razvan,
Please submit a ticket with your domain name and FTP login details or PM me the same details.
We will apply the security patch and solve the hacker's pranks if exists.

btw, 32 domains? where did you get this info... please share with us.

John

I have already contacted the support a few hours ago, and they told me about this thread.

Right no i have deleted the domain which was affected.

Thanks for the security update Flynax.

What do you do if there are differences in the code, that are not bold green. For example, my handle_file_upload function values stop at $error. Do I add what you have in black also, or just what is in green?

Thanks flynax!

Quote:

---

Originally Posted by Eric Griffiths

What do you do if there are differences in the code, that are not bold green. For example, my handle_file_upload function values stop at $error. Do I add what you have in black also, or just what is in green?

---

copy/paste just green code

Open the file /includes/classes/rlAccount.class.php
You should add the code that is highlighted in bold green.
(!) Before you change the files, back up the files to be modified.

[line: ~152]

Code:

---

Only registered members can view the code.

---

[line: ~588]

Code:

---

Only registered members can view the code.

---

[line: ~2371]

Code:

---

Only registered members can view the code.

---

[line: ~2396]

Code:

---

Only registered members can view the code.

---

[line: ~2396]

Code:

---

Only registered members can view the code.

---

to be continue...

Would it be easier if you just upload the new file and instruct us to backup and reupload?

Dont think so as many have customized their scripts.

Btw. how many fixes will follow?

Quote:

---

Originally Posted by Pawel Steinborn

Btw. how many fixes will follow?

---

I understand that in the section

Quote:

---

The other minor vulnerabilities, which will not affect stability and security of your site, will be posted later in this thread.

---

from http://www.flynax.com/forum/showthre...ull=1#post6548 there are/will be some links for rlAccount.class.php, rlListings.class.php, rlCategories.class.php, rlSearch.class.php, rlPlan.class.php
And these are the fixes.

/libs/system.lib.php

Find the code: (~ line 65)

PHP Code:

---

Only registered members can view the code. 


---

and replace to:

PHP Code:

---

Only registered members can view the code. 


---

|php2 has been added

Hi @ all

I think and hope that this security updates are only a beginning.
I would suggest the team still following.
Check out all the forms. Especially the search forms and implement for all input fields a filter for metacharacters!
It starts with the registration form and ends with the contact form.
XSS attacks is there a potentially dangerous attack point.

//Steffen

I have checked the script with Acunetix Web Vulnerability Scanner.
Therefore, the above recommendation.

Also following was a result of the check:

Cookie name: "PHPSESSID"
- If possible, you should set the HTTPOnly flag for this cookie.
- If possible, you should set the Secure flag for this cookie.

//Steffen

Open the file /includes/classes/rlListings.class.php
You should add the code that is highlighted in bold green.
(!) Before you change the files, back up the files to be modified.


[line: ~583]

Code:

---

Only registered members can view the code.

---

[line: ~618]

Code:

---

Only registered members can view the code.

---

[line: ~781]

Code:

---

Only registered members can view the code.

---

[line: ~1272]

Code:

---

Only registered members can view the code.

---

[line: ~1477]

Code:

---

Only registered members can view the code.

---

[line: ~1558]

Code:

---

Only registered members can view the code.

---

[line: ~1695]

Code:

---

Only registered members can view the code.

---

[line: ~1784]

Code:

---

Only registered members can view the code.

---

[line: ~2027]

Code:

---

Only registered members can view the code.

---

[line: ~2134]

Code:

---

Only registered members can view the code.

---

[line: ~2205]

Code:

---

Only registered members can view the code.

---

[line: ~3444]

Code:

---

Only registered members can view the code.

---

to be continue...

Open the file /includes/classes/rlCategories.class.php
You should add the code that is highlighted in bold green.
(!) Before you change the files, back up the files to be modified.

[line: ~170]

Code:

---

Only registered members can view the code.

---

[line: ~489]

Code:

---

Only registered members can view the code.

---

[line: ~589]

Code:

---

Only registered members can view the code.

---

[line: ~1298]

Code:

---

Only registered members can view the code.

---

[line: ~1351]

Code:

---

Only registered members can view the code.

---

[line: ~1459]

Code:

---

Only registered members can view the code.

---

[line: ~1492]

Code:

---

Only registered members can view the code.

---

[line: ~1527]

Code:

---

Only registered members can view the code.

---

[line: ~1617]

Code:

---

Only registered members can view the code.

---

[line: ~1868]

Code:

---

Only registered members can view the code.

---

[line: ~2001]

Code:

---

Only registered members can view the code.

---

to be continue...

Done
Thanks for the security update.

Nguyen

Quote:

---

Originally Posted by Exe

[line: ~781]

Code:

---

Only registered members can view the code.

---

---

in my original rlListings.class.php file

Code:

---

Only registered members can view the code.

---

is on the line 875 and on the line 914-915 there is only

Code:

---

Only registered members can view the code.

---

and not

Code:

---

Only registered members can view the code.

---

Quote:

---

[line: ~2027]

Code:

---

Only registered members can view the code.

---

---

On the line 2121 I have

Code:

---

Only registered members can view the code.

---

and not

Code:

---

Only registered members can view the code.

---

A few words on the future..

[line: ~781], [line: ~2027], etc..
This is approximate lines...
Of course they may be different; as well as the code itself.


Matthias

Quote:

---

Originally Posted by Exe

You should add the code that is highlighted in bold green.

---

Open the file /includes/classes/rlSearch.class.php
You should add the code that is highlighted in bold green.
(!) Before you change the files, back up the files to be modified.


[line: ~83]

Code:

---

Only registered members can view the code.

---

[line: ~139]

Code:

---

Only registered members can view the code.

---

[line: ~1048]

Code:

---

Only registered members can view the code.

---

to be continue...

Open the file /includes/classes/rlPlan.class.php
You should add the code that is highlighted in bold green.
(!) Before you change the files, back up the files to be modified.


[line: ~63]

Code:

---

Only registered members can view the code.

---

[line: ~103]

Code:

---

Only registered members can view the code.

---

[line: ~146]

Code:

---

Only registered members can view the code.

---

[line: ~181]

Code:

---

Only registered members can view the code.

---

[line: ~264]

Code:

---

Only registered members can view the code.

---

[line: ~377]

Code:

---

Only registered members can view the code.

---

Hi Alex,

I have just finished it. I like it.

Thanks
Nguyen

Hi Alex,

Thank you very much for the fixes posted.

Bert

Hi Alex

Am I correct in assuming these are the changes that were going to be on the following thread as per earliler in this thread

http://www.flynax.com/forum/showthre...ull=1#post6548

This link no longer works.

Cheers

David

all these fixes are included into the latest version we can download for our templates?

Quote:

---

Originally Posted by Petrache Nicolae

all these fixes are included into the latest version we can download for our templates?

---

Hi Petrache Nicolae,

I think NO. If u need hepl. Please contact me

Nguyen,
AutoClassi

Quote:

---

Originally Posted by Alex

Open the file /includes/classes/rlPlan.class.php
You should add the code that is highlighted in bold green.
(!) Before you change the files, back up the files to be modified.


[line: ~63]

Code:

---

Only registered members can view the code.

---

[line: ~103]

Code:

---

Only registered members can view the code.

---

[line: ~146]

Code:

---

Only registered members can view the code.

---

[line: ~181]

Code:

---

Only registered members can view the code.

---

[line: ~264]

Code:

---

Only registered members can view the code.

---

[line: ~377]

Code:

---

Only registered members can view the code.

---

---

all these fixes are included into the latest version we can download for our templates?

Quote:

---

Originally Posted by Petrache Nicolae

all these fixes are included into the latest version we can download for our templates?

---

Yes, it's included.

I re installed the script on 18nth october 2013, from flynax download, do i need to edit the files.?

Quote:

---

Originally Posted by Manikandan Subramanian

I re installed the script on 18nth october 2013, from flynax download, do i need to edit the files.?

---

No, this is not necessary.

problem is solved .................