hi, we have new vulnerability in wakaba:
if you include html tags in wakaba mark like irc : irc:<some html tegs>, you can include in thread any what you want.
yes its realy working, and users can hacked wakaba.
any ideas how fix?
Well, that clearly doesn't work, as you demonstrated. If you can figure out what actually triggers it, I can do something about it, but that isn't it.
Also, upgrade to the newest version, it has some fixes that may be related.
oh, sry my english bad, but i try answer more correct.
I`m using wakaba 3.0.8.
Problem in any wakaba marks, which applies to url link.
news, irc, http, https, mailto.
User can include code, wich end of code her post.
Its starting as: irc:</blockquote> and some next end-tags of post.
And in this wakaba not filtered it. In result after end-tags, you can include starting-tags for new post - and in results it will be double-post like a 2 or more messages.
I was forced to disable all marks(news, irc, http, https, mailto), because hackers have more fantasy and did all threads in only 1!! omg.
sry for bad english, but i hope you anderstand what i mean.
oh, look here: http://2-ch.ru/bg/
This directory now actual was hacking.
(in this directory wakaba marks not removed for demonstration hacking)
(Note: Scroll its not hack. Hack it`s all threads in one)
No tags have been injected there, it's just that link tag argument has somehow been left unclosed, eating up some of the following markup and breaking the layout. It's not dangerous, just annoying.
I have no idea how exactly that would happen, though. Anybody else have any guesses?
see it's ok here.
>>8
here kareha, she possibly not have this vulnerability,
but on wakaba it work 100%
ДВач запилили мне быстро!
I found cause of this bug.
We use full utf8 encoding. include "sen names utf8" in wakaba.pl for correct data in db mysql. (because default connect on server db not utf8)
But in this case - wakaba starting acepting and processing special utf8 symbols. like a: , , , and many others. And they destroy html code in wakaba template. if they will be added in links likes( http:// ).
i was trying change "use constant MAX_UNICODE => 1114111;" to 65536. But no have efect. Wakaba stil continue acepting this symbols.
Maybe someone know - how to force wakaba to stop processing this symbols?
I wiil be wait any answers. Thank you.
CD Taxa(3)