Does this affect 2.0?

Hi All

I've been looking into this myself. the suggested fix is what is needed, however i wish to add something else here, PASSWORDS!

The people behind this only seem to use this hack when they search for new sites ('My new Exponent site' etc)

http://www.google.com.sa/search?hl=ar&safe=active&client=firefox-a&rls=org.mozilla:ar:official&hs=qL5&q=%22my+new+exponent+site%22&start=10&sa=N according to my server logs anyway. They then go to the www.example.com/login.php and try their luck with admin admin etc then pass in the info to the URL to inject the code.

r--

There are many sites out there that keep a huge list of passwords and their MD5 equivilents. it doesn't take a genius to find and use these just ask Google for MD5 reverse passwords and you'll get a hundred sites offering this so........if you have week passwords...change them. That goes for databse passwords, admin password and ftp.

I know that there are a lot of people out there working on supplying the fix/patch for this as we speak. However in the meantime please be a secure as possible with your passwords and code. What has been suggested at the top of this post is excellent and with a combination of both suggestions here it will secure your site against this sort of hack.

Just a bit more info on it really.

Rob

it's right share the hack fix not to write how to make a hacking a exponent web site....

remove this link please.. ;)

Here is a quick and dirty fix for the current issues.
In 2.0 and .97 sites, open your index.php and find:
$router->routeRequest();

Add this right underneath:

foreach ($_GET as $key=>$gp)
{
if ($key == 'id') $_GET[$key] = intval($gp);
}

I'm not sure the ideal place to put it in a 96.3 install, but perhaps someone can work that out and post.

You could also just check for $_GET['id'] isset and !is_numeric and intval it if true.

Ideally, we need to sanitize all input throughout the system. It is in many places, but obviously not in others. This should help for the time being though.

yes, good idea!

And I think is much better to use exponent_users_isLoggedIn() function for testing if there is a proper $user variable set, instead of simple " if ($user) { .... " 

If i am understanding these posts I need to add if (isset($_GET['id']) && !is_numeric($_GET['id'])) $_GET['id'] = intval($_GET['id']); below $router->routeRequest(); in index.php. Also table prefixes should be something other than exponent. Is there a quick way to rename all the tables in my database? Or do I have to rename all the one at a time. I did them one at a time on my test install using phpMyAdmin. I have 4 other production sites to fix so I would like to find the best way to fix these issues.

Thanks for that link. I just tried it and it works great!