Flexible, user-friendly
membership software
05/27/2009
There is a serious security problem found in aMember Pro. It affects aMember Pro versions up to 3.1.7. A hacker is able to insert Javascript into first and last name fields, then when you are viewing his account in aMember CP, a malicious Javascript could be executed, and admin session can be stolen.
The problem described here: http://www.securityfocus.com/archive/1/503776/30/0/threaded
if (!strlen($vars['name_f'])){
$error[] = _SIGNUP_PLEASE_ENTER_FNAME;
}
if (!strlen($vars['name_l'])){
$error[] = _SIGNUP_PLEASE_ENTER_LNAME;
}
and replace it to
if (!strlen($vars['name_f'])){
$error[] = _SIGNUP_PLEASE_ENTER_FNAME;
}
if (preg_match('/[<>"]/', $vars['name_f'])){
$error[] = _SIGNUP_PLEASE_ENTER_FNAME;
}
if (!strlen($vars['name_l'])){
$error[] = _SIGNUP_PLEASE_ENTER_LNAME;
}
if (preg_match('/[<>"]/', $vars['name_l'])){
$error[] = _SIGNUP_PLEASE_ENTER_LNAME;
}
if (($k == 'name_f') && !strlen($v)){
$error[] = _MEMBER_PROFILE_ERROR4;
$user['name_f'] = $v;
continue;
}
if (($k == 'name_l') && !strlen($v)){
$error[] = _MEMBER_PROFILE_ERROR5;
$user['name_l'] = $v;
continue;
}
and replace it to the following lines:
if (($k == 'name_f') && !strlen($v)){
$error[] = _MEMBER_PROFILE_ERROR4;
$user['name_f'] = $v;
continue;
}
if (($k == 'name_l') && !strlen($v)){
$error[] = _MEMBER_PROFILE_ERROR5;
$user['name_l'] = $v;
continue;
}
if (($k == 'name_f') && preg_match('/[<>"]/', $v)){
$error[] = _MEMBER_PROFILE_ERROR4;
$user['name_f'] = $v;
continue;
}
if (($k == 'name_l') && preg_match('/[<>"]/', $v)){
$error[] = _MEMBER_PROFILE_ERROR5;
$user['name_l'] = $v;
continue;
}
$badWords = array('script', 'onabort', 'onactivate',
'onafterprint', 'onafterupdate', 'onbeforeactivate', 'onbeforecopy',
'onbeforecut', 'onbeforedeactivate', 'onbeforeeditfocus', 'onbeforepaste',
'onbeforeprint', 'onbeforeunload', 'onbeforeupdate', 'onblur', 'onbounce',
'oncellchange', 'onchange', 'onclick', 'oncontextmenu', 'oncontrolselect',
'oncopy', 'oncut', 'ondataavailable', 'ondatasetchanged', 'ondatasetcomplete',
'ondblclick', 'ondeactivate', 'ondrag', 'ondragdrop', 'ondragend', 'ondragenter',
'ondragleave', 'ondragover', 'ondragstart', 'ondrop', 'onerror', 'onerrorupdate',
'onfilterupdate', 'onfinish', 'onfocus', 'onfocusin', 'onfocusout', 'onhelp', 'onkeydown',
'onkeypress', 'onkeyup', 'onlayoutcomplete', 'onload', 'onlosecapture', 'onmousedown',
'onmouseenter', 'onmouseleave', 'onmousemove', 'onmoveout', 'onmouseover', 'onmouseup',
'onmousewheel', 'onmove', 'onmoveend', 'onmovestart', 'onpaste', 'onpropertychange',
'onreadystatechange', 'onreset', 'onresize', 'onresizeend', 'onresizestart', 'onrowexit',
'onrowsdelete', 'onrowsinserted', 'onscroll', 'onselect', 'onselectionchange', 'onselectstart',
'onstart', 'onstop', 'onsubmit', 'onunload');
foreach ($_GET as $k => $v)
if (@preg_match('/\b'.join('|', $badWords).'\b/', $v))
die('Bad word detected in GET parameter, access deined');
