Warning for IndexScript powered directory owners

I have noticed in my directory a lot of directories submitted that were hacked because of an exploit that was recently published:

http://secunia.com/advisories/26218/

Webmasters using IndexScript should update to the latest version, so that they are not vulnerable.
Also, you should remove the Powered by Indexscript in the footer or convert that text to an image because hackers can use that phrase to find directories to hack.

Sorry if it was already said or if it's the wrong category, I can't think of a better one right now.

Fix appears to be here: http://www.indexscript.com/forum/showthread.php?t=2266 (though from what i read in the forum post he's somewhat lousy at programming php)

 

I really take offense at what you have said in this post.

First off this is very old news. The script was fixed the same day the problem was discovered.

The programmer chose to be modest and admit that he made a mistake. And you want to make a big deal out it.

If you were a regular user and visitor to the indexscipt site you would have know about this and had the fix the first day the problem occurred.

 

Agreed Index script or daboss here at DP, had a fix within 24 hours as i have one of their scripts

thx
malcolm

 

I think the onus is more on the directory owner here. We had to remove a few directories in our last update, because they remain hacked despite the fix being available.

You can't blame the programmer if the owners won't employ the fix.

 

The last update to Secunia advisory was two months ago and even so, I still see hacked directories when I review old submissions or directories submitted only a week or so ago. I don't think it's bad to remind people and I don't see why it bothers you so much, considering there are worse offenders than me.

I don't have anything with the programmer, it's just that his method of fixing the issue shown in the forum does not make me trust him more, that he would be able to fix other vulnerabilities.

You don't fix something like this by looking by adding in the function with problems code like this:

  if(stristr($temp, "dir_login")) {
    $temp = "";
  }

PHP:

which essentially looks in the string for "dir_login" and clears the string if dir_login is found.
To make an example, if I'd probably submit the website "http://www.mydir_login.com" the escape function will now clear the url before submitting to the database because it contains the string "dir_login".
I didn't check the script in detail because I don't use it, I write my own scripts, so it may not be true what I say anymore.

An easier way to fix this exploit would have been to teach users how to remove UNION right in mySQL and to properly test if the received parameter was a number, not a string.