web-erp-developers

[WebERP-developers] Important: Serious security issue

[Phil D. <ph...@lo...>]

An important heads up - a serious hole has been discovered - my fault 
sorry everyone... the script

GLTrialBalance_csv.php

should be removed from your installation immediately.

This script allows anyone to access your general ledger trial balance!

Phil

-------- Original Message --------
Subject: 	Re: Serious security issue
Date: 	Thu, 20 Feb 2014 08:48:21 +0800
From: 	Exson Qu <hex...@gm...>
To: 	Phil Daintree <ph...@lo...>



*Hi, Phil,
*
              Thank you for your prompt reply.

              Yes. A heads up is needed since it's too dangerous for 
those put webERP on internet. Just google the login screen and you'll 
get lots of company's TB via this method.

             Thanks and best regards!

              Exson






2014-02-20 1:25 GMT+08:00 Phil Daintree <ph...@lo... 
<mailto:ph...@lo...>>:

    I see jo has fixed it.
    Perhaps i should publish a heads up.


    On 20 February 2014 12:55:47 AM NZDT, Exson Qu <hex...@gm...
    <mailto:hex...@gm...>> wrote:

        *Hi, Phil,*

                   The affected version is since 4630 which add
        $AllowAnyone Check in session.inc which make the security
        absolutely broken.

                  We can temporary remove the and !$AllowAnyone check in
        line 335. It'll check the formID to block those non-authority
        users. But an authority user still can work this around.

                And same problem lies in scripts:
        RecurringSalesOrdersProcess.php.

                The problem is that system judge a login status by
        $_SESSION['DatabaseName'] has been set or not.
                 And the $AllowAnyone has broken the last formID
        security check.

                 Thank you for your attention!

                Thanks and best regards!

                Exson

Re: [WebERP-developers] Important: Serious security issue

[gilberto d. s. a. <gs...@gm...>]

See that double security always protect http server apache. use of
.htaccess ALWAYS protect for basic access.
I think that GLTrialBalance_csv.php  could show unrelated information about
weberp environment, but not for all internet IF some one admin with
experience handle and take admin procedures for protection of weberp
environment.
Thanks for your warning.


2014-02-20 5:03 GMT-03:00 Phil Daintree <ph...@lo...>:

>
> An important heads up - a serious hole has been discovered - my fault
> sorry everyone... the script
>
> GLTrialBalance_csv.php
>
> should be removed from your installation immediately.
>
> This script allows anyone to access your general ledger trial balance!
>
> Phil
>
> -------- Original Message --------  Subject: Re: Serious security issue  Date:
> Thu, 20 Feb 2014 08:48:21 +0800  From: Exson Qu <hex...@gm...><hex...@gm...>  To:
> Phil Daintree <ph...@lo...> <ph...@lo...>
>
>
> *Hi, Phil, *
>               Thank you for your prompt reply.
>
>               Yes. A heads up is needed since it's too dangerous for those
> put webERP on internet. Just google the login screen and you'll get lots of
> company's TB via this method.
>
>              Thanks and best regards!
>
>               Exson
>
>
>
>
>
>
> 2014-02-20 1:25 GMT+08:00 Phil Daintree <ph...@lo...>:
>
>> I see jo has fixed it.
>> Perhaps i should publish a heads up.
>>
>>
>> On 20 February 2014 12:55:47 AM NZDT, Exson Qu <hex...@gm...>
>> wrote:
>>>
>>>     *Hi, Phil,*
>>>
>>>              The affected version is since 4630 which add $AllowAnyone
>>> Check in session.inc which make the security absolutely broken.
>>>
>>>           We can temporary remove the and !$AllowAnyone check in line
>>> 335. It'll check the formID to block those non-authority users. But an
>>> authority user still can work this around.
>>>
>>>         And same problem lies in scripts:
>>> RecurringSalesOrdersProcess.php.
>>>
>>>         The problem is that system judge a login status by
>>> $_SESSION['DatabaseName'] has been set or not.
>>>          And the $AllowAnyone has broken the last formID security
>>> check.
>>>
>>>          Thank you for your attention!
>>>
>>>         Thanks and best regards!
>>>
>>>         Exson
>>>
>>>
>>
>>
>
>
>
>
> ------------------------------------------------------------------------------
> Managing the Performance of Cloud-Based Applications
> Take advantage of what the Cloud has to offer - Avoid Common Pitfalls.
> Read the Whitepaper.
>
> http://pubads.g.doubleclick.net/gampad/clk?id=121054471&iu=/4140/ostg.clktrk
> _______________________________________________
> Web-erp-developers mailing list
> Web...@li...
> https://lists.sourceforge.net/lists/listinfo/web-erp-developers
>
>


-- 
gilberto dos santos alves
+55.11.98646-5049
sao paulo - sp - brasil