Reply to thread

Message

<blockquote data-quote="Gajeel" data-source="post: 93544" data-attributes="member: 7688">[CODE]&nbsp; &lt;link rel=&quot;stylesheet&quot; href=&quot;{url}/app/tpl/skins/{skin}/hk/styles/global.css&quot; type=&quot;text/css&quot;&gt;&lt;div id=&quot;main&quot;&gt;&nbsp; &nbsp; &lt;div id=&quot;links&quot;&gt;&lt;/div&gt;&nbsp; &nbsp; &lt;div id=&quot;header&quot;&gt;&lt;img src=&quot;{url}/app/tpl/skins/{skin}/images/logo.png&quot; align=right style=&quot;margin-right: 480px; margin-top: 5px;&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;div id=&quot;logo&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;div id=&quot;logo_text&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;!-- class=&quot;logo_colour&quot;, allows you to change the color of the logo text --&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;h1&gt;{hotelname} Housekeeping -- Welcome {username}&lt;/h1&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/div&gt;&nbsp; &nbsp; &nbsp; &lt;/div&gt;&nbsp; &nbsp; &lt;/div&gt;&nbsp; &nbsp; &lt;div id=&quot;site_content&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;div id=&quot;sidebar_container&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;!-- insert your sidebar items here --&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;div class=&quot;sidebar&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;div class=&quot;sidebar_top&quot;&gt;&lt;/div&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;div class=&quot;sidebar_item&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [ &lt;a href='dash'&gt;Return to Dashboard&lt;/a&gt; ] [ &lt;a href='logout'&gt;Log out&lt;/a&gt; ]&lt;br /&gt; &lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;p&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;?php if(mysql_result(mysql_query(&quot;SELECT rank FROM users WHERE id = '&quot; . $_SESSION['user']['id'] . &quot;'&quot;), 0) &gt;= 5)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; { ?&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Player Management &lt;br /&gt; &lt;img src='../app/tpl/skins/&lt;?php echo $_CONFIG['template']['style']; ?&gt;/hk/images/line.png'&gt; &lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &amp;raquo; &lt;a href='vip'&gt;Give a user Regular VIP&lt;/a&gt; &lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &amp;raquo; &lt;a href='svip'&gt;Give a user Super VIP&lt;/a&gt; &lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &amp;raquo; &lt;a href='edit'&gt;Edit a users account&lt;/a&gt; &lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Administration &lt;br /&gt; &lt;img src='../app/tpl/skins/&lt;?php echo $_CONFIG['template']['style']; ?&gt;/hk/images/line.png'&gt; &lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &amp;raquo; &lt;a href='news'&gt;Post news article&lt;/a&gt;&lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &amp;raquo; &lt;a href='delnews'&gt;Delete a news article (By ID)&lt;/a&gt;&lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &amp;raquo; &lt;a href='cmdlogs'&gt;Command logs&lt;/a&gt;&lt;br /&gt;&amp;raquo; &lt;a href='motd'&gt;Change welcome message&lt;/a&gt;&lt;br /&gt;&amp;raquo; &lt;a href='empty'&gt;Empty a table&lt;/a&gt;&lt;br /&gt;&amp;raquo; &lt;a href='timer'&gt;Change the Credits &amp; Pixels timer&lt;/a&gt;&lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;?php } if(mysql_result(mysql_query(&quot;SELECT rank FROM users WHERE id = '&quot; . $_SESSION['user']['id'] . &quot;'&quot;), 0) &gt;= 5) { ?&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Moderation &lt;br /&gt; &lt;img src='../app/tpl/skins/&lt;?php echo $_CONFIG['template']['style']; ?&gt;/hk/images/line.png'&gt; &lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &amp;raquo; &lt;a href='banlist'&gt;Ban List&lt;/a&gt; &lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &amp;raquo; &lt;a href='ip'&gt;IP lookup&lt;/a&gt; &lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Badges &lt;br /&gt; &lt;img src='../app/tpl/skins/&lt;?php echo $_CONFIG['template']['style']; ?&gt;/hk/images/line.png'&gt; &lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &amp;raquo; &lt;a href='listbadge'&gt;List badges&lt;/a&gt;&lt;br /&gt;&amp;raquo; &lt;a href='addbadge'&gt;Add a badge&lt;/a&gt;&lt;br /&gt;&amp;raquo; &lt;a href='delbadge'&gt;Delete a badge&lt;/a&gt;&lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;?php } ?&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Statistics&lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;img src='../app/tpl/skins/&lt;?php echo $_CONFIG['template']['style']; ?&gt;/hk/images/line.png'&gt; &lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Server Status:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {status} &lt;br /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {online} user(s) online &lt;br /&gt;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/p&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/div&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;div class=&quot;sidebar_base&quot;&gt;&lt;/div&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/div&gt;&nbsp; &nbsp; &nbsp; &lt;/div&gt;&nbsp; &nbsp; &nbsp; &lt;div id=&quot;content_container&quot;&gt;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &lt;div id=&quot;content&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;!-- insert the page content here --&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;br /&gt;&nbsp; &nbsp; &nbsp;&nbsp; &lt;?phpif(!isset($_SESSION[&quot;longstory&quot;])){&nbsp; &nbsp; header(&quot;Location: &quot;.$_CONFIG['hotel']['url'].&quot;/ase/news&quot;);&nbsp; &nbsp; exit;}&nbsp;if(isset($_POST[&quot;proceed&quot;])){$topstory = mysql_real_escape_string($_POST[&quot;topstory&quot;]);&nbsp; &nbsp; $author = mysql_result(mysql_query(&quot;SELECT username FROM users WHERE id = '&quot;.$_SESSION['user']['id'].&quot;' LIMIT 1&quot;), 0);&nbsp; &nbsp; mysql_query(&quot;INSERT INTO cms_news (title,shortstory,longstory,published,image,author, campaign, campaignimg) VALUES ('&quot; . $_SESSION[&quot;title&quot;] . &quot;', '&quot; . $_SESSION[&quot;shortstory&quot;] . &quot;', '&quot; . $_SESSION[&quot;longstory&quot;] . &quot;', '&quot; . time() . &quot;', '&quot; . $topstory . &quot;', '&quot; . $author . &quot;', 0, 'default')&quot;) or die(mysql_error());&nbsp; &nbsp; unset($_SESSION[&quot;title&quot;], $_SESSION[&quot;shortstory&quot;], $_SESSION[&quot;longstory&quot;]);&nbsp; &nbsp; header(&quot;Location: &quot;.$_CONFIG['hotel']['url'].&quot;/ase/&quot;);&nbsp; &nbsp; exit;}&nbsp; &nbsp; echo '&lt;center&gt;&lt;b&gt;You are writing news article &lt;u&gt;'.$_SESSION[&quot;title&quot;].'.&lt;/u&gt;&lt;br /&gt;';&nbsp; &nbsp; echo 'It\'s time to choose the image for your story. Choose one from the drop down list and click &quot;Check Image&quot;';&nbsp; &nbsp; echo '&lt;form method=&quot;post&quot;&gt;';&nbsp; &nbsp; echo '&lt;br /&gt;';&nbsp; &nbsp; echo '&lt;select name=&quot;topstory&quot; id=&quot;topstory&quot; style=&quot;font-size: 14px;&quot;';&nbsp;&nbsp; &nbsp; &nbsp; if ($handle = opendir('ts/'))&nbsp; &nbsp; {&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; while (false !== ($file = readdir($handle)))&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if ($file == '.' || $file == '..')&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; continue;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;&nbsp; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo '&lt;option value=&quot;' . $file . '&quot;';&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (isset($_POST['topstory']) &amp;&amp; $_POST['topstory'] == $file)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo ' selected';&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo '&gt;' . $file . '&lt;/option&gt;';&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp;&nbsp; &nbsp; echo '&lt;/select&gt;';&nbsp;&nbsp; &nbsp; &nbsp; if(isset($_POST[&quot;check&quot;]))&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; echo '&lt;br /&gt; &lt;br /&gt; &lt;input type=&quot;submit&quot; value=&quot;&nbsp; Check image&nbsp; &quot; name=&quot;check&quot; /&gt; &lt;br /&gt;&lt;br /&gt;';&nbsp; &nbsp; &nbsp; &nbsp; echo '&lt;font size=&quot;3&quot;&gt;Topstory image&lt;br /&gt;&lt;/font&gt;&lt;img src=&quot;ts/' . $_POST[&quot;topstory&quot;] . '&quot; align=&quot;right /&gt;';&nbsp; &nbsp; &nbsp; &nbsp; echo '&lt;/center&gt; &lt;align=&quot;right&quot;&gt; &lt;br /&gt; &lt;br /&gt; &lt;input type=&quot;submit&quot; value=&quot;&nbsp; Proceed (use image)&nbsp; &quot; name=&quot;proceed&quot; /&gt; &lt;br /&gt;';&nbsp; &nbsp; &nbsp; &nbsp; echo '&lt;/form&gt;';&nbsp; &nbsp; }&nbsp; &nbsp; else&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; echo '&lt;br /&gt; &lt;br /&gt; &lt;input type=&quot;submit&quot; value=&quot;&nbsp; Check image&nbsp; &quot; name=&quot;check&quot; /&gt; &lt;br /&gt;';&nbsp; &nbsp; &nbsp; &nbsp; echo &quot;&lt;/form&gt;&quot;;&nbsp; &nbsp; }&nbsp;?&gt;[/CODE]&nbsp;This is the news2.php for <a href="http://habprohotel.co.uk" target="_blank">http://habprohotel.co.uk</a>. The fix was coded by <a href="http://devbest.com/members/muffins.14117/" target="_blank">Muffins</a> and this news2.php is for Grapefruit ASE, so you need to edit certain things there. I have copy-pasted the full file as it seems I cannot find where the original 66th line content was. I asked Muffins to make one secured patch for it and if any PHP coder out there, feel free to inspect if this is not vulnerable.&nbsp;Many thanks,Vineen</blockquote>

[QUOTE="Gajeel, post: 93544, member: 7688"] [CODE] <link rel="stylesheet" href="{url}/app/tpl/skins/{skin}/hk/styles/global.css" type="text/css"> <div id="main"> <div id="links"></div> <div id="header"><img src="{url}/app/tpl/skins/{skin}/images/logo.png" align=right style="margin-right: 480px; margin-top: 5px;"> <div id="logo"> <div id="logo_text">  <h1>{hotelname} Housekeeping -- Welcome {username}</h1> </div> </div> </div> <div id="site_content"> <div id="sidebar_container">  <div class="sidebar"> <div class="sidebar_top"></div> <div class="sidebar_item"> [ <a href='dash'>Return to Dashboard</a> ] [ <a href='logout'>Log out</a> ] <?php if(mysql_result(mysql_query("SELECT rank FROM users WHERE id = '" . $_SESSION['user']['id'] . "'"), 0) >= 5) { ?> Player Management <img src='../app/tpl/skins/<?php echo $_CONFIG['template']['style']; ?>/hk/images/line.png'> » <a href='vip'>Give a user Regular VIP</a> » <a href='svip'>Give a user Super VIP</a> » <a href='edit'>Edit a users account</a> Administration <img src='../app/tpl/skins/<?php echo $_CONFIG['template']['style']; ?>/hk/images/line.png'> » <a href='news'>Post news article</a> » <a href='delnews'>Delete a news article (By ID)</a> » <a href='cmdlogs'>Command logs</a> » <a href='motd'>Change welcome message</a> » <a href='empty'>Empty a table</a> » <a href='timer'>Change the Credits & Pixels timer</a> <?php } if(mysql_result(mysql_query("SELECT rank FROM users WHERE id = '" . $_SESSION['user']['id'] . "'"), 0) >= 5) { ?> Moderation <img src='../app/tpl/skins/<?php echo $_CONFIG['template']['style']; ?>/hk/images/line.png'> » <a href='banlist'>Ban List</a> » <a href='ip'>IP lookup</a> Badges <img src='../app/tpl/skins/<?php echo $_CONFIG['template']['style']; ?>/hk/images/line.png'> » <a href='listbadge'>List badges</a> » <a href='addbadge'>Add a badge</a> » <a href='delbadge'>Delete a badge</a> <?php } ?> Statistics <img src='../app/tpl/skins/<?php echo $_CONFIG['template']['style']; ?>/hk/images/line.png'> Server Status: {status} {online} user(s) online </div> <div class="sidebar_base"></div> </div> </div> <div id="content_container"> <div id="content">  <?php if(!isset($_SESSION["longstory"])) { header("Location: ".$_CONFIG['hotel']['url']."/ase/news"); exit; } if(isset($_POST["proceed"])) { $topstory = mysql_real_escape_string($_POST["topstory"]); $author = mysql_result(mysql_query("SELECT username FROM users WHERE id = '".$_SESSION['user']['id']."' LIMIT 1"), 0); mysql_query("INSERT INTO cms_news (title,shortstory,longstory,published,image,author, campaign, campaignimg) VALUES ('" . $_SESSION["title"] . "', '" . $_SESSION["shortstory"] . "', '" . $_SESSION["longstory"] . "', '" . time() . "', '" . $topstory . "', '" . $author . "', 0, 'default')") or die(mysql_error()); unset($_SESSION["title"], $_SESSION["shortstory"], $_SESSION["longstory"]); header("Location: ".$_CONFIG['hotel']['url']."/ase/"); exit; } echo '<center>You are writing news article '.$_SESSION["title"].'. '; echo 'It\'s time to choose the image for your story. Choose one from the drop down list and click "Check Image"'; echo '<form method="post">'; echo ' '; echo '<select name="topstory" id="topstory" style="font-size: 14px;"'; if ($handle = opendir('ts/')) { while (false !== ($file = readdir($handle))) { if ($file == '.' || $file == '..') { continue; } echo '<option value="' . $file . '"'; if (isset($_POST['topstory']) && $_POST['topstory'] == $file) { echo ' selected'; } echo '>' . $file . '</option>'; } } echo '</select>'; if(isset($_POST["check"])) { echo ' <input type="submit" value=" Check image " name="check" /> '; echo 'Topstory image <img src="ts/' . $_POST["topstory"] . '" align="right />'; echo '</center> <align="right"> <input type="submit" value=" Proceed (use image) " name="proceed" /> '; echo '</form>'; } else { echo ' <input type="submit" value=" Check image " name="check" /> '; echo "</form>"; } ?>[/CODE] This is the [B]news2.php[/B] for [url]http://habprohotel.co.uk[/url]. The fix was coded by [URL='http://devbest.com/members/muffins.14117/']Muffins[/URL] and this news2.php is for Grapefruit ASE, so you need to edit certain things there. I have copy-pasted the full file as it seems I cannot find where the original 66th line content was. I asked Muffins to make one secured patch for it and if any [B]PHP coder[/B] out there, feel free to inspect if this is not vulnerable. Many thanks, Vineen [/QUOTE]

Verification

Reply to thread

Connect with us

Newest members