28.04.06 - Найдена еще одна уязвимость в IPB 2.x

[j4ck]

http://secunia.com/advisories/19861/

 

ошибка думаю в ./sources/messenger.php

 

возможно здесь

 

   1430				 $ibforums->input['from_contact'] = $ibforums->input['from_contact'] ? $ibforums->input['from_contact'] : '-';
  1431
  1432				 //-----------------------------------------
  1433				 // Error checking
  1434				 //-----------------------------------------
  1435
  1436				 if ( strlen($ibforums->input['msg_title']) < 2 )
  1437				 {
  1438						 $this->lib->send_form( 0, $ibforums->lang['err_no_title'] );
  1439						 $this->output .= $this->lib->output;
  1440						 return;
  1441				 }
  1442
  1443				 if ( strlen($ibforums->input['Post']) < 2 )
  1444				 {
  1445						 $this->lib->send_form( 0, $ibforums->lang['err_no_msg'] );
  1446						 $this->output .= $this->lib->output;
  1447						 return;
  1448				 }
  1449
  1450				 if ($ibforums->input['from_contact'] == '-' and $ibforums->input['entered_name'] == "")
  1451				 {
  1452						 $this->lib->send_form( 0, $ibforums->lang['err_no_chosen_member'] );
  1453						 $this->output .= $this->lib->output;
  1454						 return;
  1455				 }
  1456
  1457				 //-----------------------------------------
  1458				 // TO:
  1459				 //-----------------------------------------
  1460
  1461				 if ($ibforums->input['from_contact'] == '-')
  1462				 {
  1463						 $this->lib->to = $ibforums->input['entered_name'];
  1464				 }
  1465				 else
  1466				 {
  1467						 $this->lib->to_by_id = $ibforums->input['from_contact'];

код версии 2.0.3

 

вендоры, кстати, молчат

 

что делать?

[-=MIF=-]

Уязвимости форумов Invision Power Board