FuseTalk question

[WhiteAngel]

I'm new to this forum, so far have been more than happy with speedy responses to questions I have had.
Now I have another one...
I have been looking into forums for some time now, because I've been looking for one to use for my next site. I looked into this one that Anandtech is using called FuseTalk and am surprised as to why the company would have released it's it's forum software with a vulnerability like the one I've found.

--- > E-Zonemedia's Fuse Talk is vulnerable to malicious SQL injection. Improper form sanitization makes it possible for any user to manipulate data as they see fit. The vulnerability is present in the sign up form (join.cfm), a well-crafted form variable will execute malicious SQL. This is caused because the form does not filtering out semi-colon (.

Example:
Examine the following code:

1;delete from users

or

1;exec sp_addlogin "whatever"

If they are passed to the time zones parameter, the following SQL will be executed:

select chdifference from timezones where itimezoneid = 1;exec sp_addlogin "whatever"

This will have the effect of adding a new user to the SQL's user database, allowing the user to logon without requiring a password.

Vulnerable code:
<cfquery name="qgetdiff" datasource="#ds#">
select chdifference from timezones where itimezoneid = #timezone#
</cfquery>


Is this for some previous version? Have they fixed this flaw? Nto about to try it out because I'd like to remain a member, but if this at all helps the moderators fix any issues they have been having with some people and want to know why. Then here it is.... If they've fixed this problem, I'd be interested in knowing.

LaterZzz M8'zz

WhiteAngel ô¿ô

 

[CTho9305]

1. edited out because I decided it wasn't a very nice thing to say. The gist was that I didn't feel fusetalk was especially secure.
2. This belongs in Forum Issues or Software, not Highly Technical.
3. That vuln is from 2001. That was in what, FuseTalk 3?
4. FuseTalk security issue threads generally get deleted... although in this case, since presumably the vuln was fixed within hte past 2 years, they might not delete it.

 

[InlineFive]

I agree with his point of view, I would like a secure forum so as hackers could not get at my password, username, email, etc. so easily.

-Por

 

[Jason Clark]

WhiteAngel, that was fixed about 5 hours after it was reported (over two years ago), and a patch was released to customers. It was a mistake no question, just like the mistakes made by the developers of windows, red hat etc where you could gain root access or delete files off of peoples machines. Welcome to software made by a human being, mistakes happen the important thing is that they are fixed. Every issue that anyone has made aware to me, including a couple from ctho were put into the bug tracking system for fusetalk. Anything serious (and there have been less than a handful) in the products life (4 years) were immediately fixed.

PorBleemo, ignore CTho9305, his comments are generally off the mark and based on personal issues he seems to have the people around here. There are no known issues where people can get your password and personal information.

 

[CTho9305]

Originally posted by: Zuni
PorBleemo, ignore CTho9305, his comments are generally off the mark and based on personal issues he seems to have the people around here.

I'm not sure where you got that from... I posted one [overly] hostile remark based on past experiences (avatar data verification, embedding images in private messages, embedding javascript in sigs, embedding script in posts, replying to "deleted" topics, unchecked data for user ratings, exposed banning.cfm, the lack of cross-browser alt+q quickreply). No offense, but one person finding more than a couple of issues like that doesn't indicate a great development process to me. Most of those are the kind of things someone should have caught in just a little bit of testing. Hence the "lazy" name-calling.

If I were the kind of person you're making me out to be, I would have been malicious and abused the holes. Instead, I reported all of the bugs I personally found.

I don't know what Por is talking about - I have yet to find any issues that revealed passwords or anything like that. Maybe he wants SSL. SSL is expensive when you have that much traffic.

 

[Jason Clark]

CTho, actually some of what you reported were already found and in the queue, and most were fairly minor issues. I've listened to all of your complaints/issues and dealt with the ones that werent already dealt with. Laziness? I guess thats what all the developers at microsoft, redhat, borland, hp, compaq etc are when they make mistakes? Honestly I think that you have a bit of a chip in for fusetalk not sure why. We're two guys that develop every line of code at fusetalk, myself and Dominic. We manage a few hundred thousand lines of code, and have one of the most complex forum packages on the market (our enterprise product). We don't have the luxury of a dedicated QA team either. I think we do a good job with the resources we have, we listen and respond to customers which is more than I can say for alot of companies out there... That being said I appreciate you reporting the issues, and never said otherwise.

No we are not perfect and we don't claim to be, but I doubt you could do a better job

Por, if SSL is what you're after it just isn't doable on a forum this size the overhead of encryption is quite substancial.

L8r

 

[CTho9305]

I didn't know you were just 2 people - that's pretty impressive for an enterprise-grade forum. I can see how bugs like that would get into the product. I assumed you had a team of people working on FuseTalk, in which case other developers should catch such oversights.

If I wrote FuseTalk, it would be secure, fast, missing many useful features, ugly as hell... probably not worth paying for .

 

[Jason Clark]

Hehe yeah when we're at dev shows and people ask how big the dev team are they are quite surprised.. we're just a couple of dev nuts I guess. A tonne of work goes into a forum more than I ever thought when we did our first version, our enterprise version is massive. We did a neat flash offline tool for it though so you can use the forum without a browser and archive threads offline for storage. Fun stuff

Cheers.

 

[RagingBITCH]

Wow my level of respect for ya just went through the roof Zuni! I know you do a lot but didn't know it was 2 guys who did Fusetalk

Hands Zuni an ice old :beer:

 

[AgaBoogaBoo]

Originally posted by: RagingBITCH
Wow my level of respect for ya just went through the roof Zuni! I know you do a lot but didn't know it was 2 guys who did Fusetalk

Hands Zuni an ice old :beer:

Yeah, same here

Have a nice :beer:

Wait, I'm 15, I can't have possesion, ah, oh well, have one anyway!

 

[DannyBoy]

Strangely enough I thought it was just you that developed Fusetalk Zuni!

My bad