Windwalker ha scritto: Hi,
I just came across this security issue:
www.joomla-security.de/sicherheitsmeldun...-icagenda-1-1-4.html
Could you please state, whether this one is fixed in the current version?
Thanks in advance,
Sascha.
Yes, it's a very old issue !
When i've begin developpement of iCagenda, i first didn't know every way of protecting, but i have work very hard to know how an attack could be done (hack learning) and how to protect it.
iCagenda is safe since 1.2.6 (Security again SQL injection and XSS, and other securities
)
You can read the update log, in your iCagenda control panel.
As there's a free version of iCagenda, Young Hackers are testing all free software to try their first "exploits", but not commercial one (for example, some events management extensions, which are commercial, on the JED listing, have many security vulenrabilities. I have contacter developper of one of this extension (popular), but he seems not to know all about security issue...)
The problem with this hackers : they don't mention on their website, when a vulnerability is fixed.
And, with Google search, you can still see the pages referenced...
So, for example, a useful test about SQL injection : change the id or itemid number by text, in url, and if you see for example, error messages, so you have : SQL injection possibilities, and Full Path disclosure vulnerabilities. (many commercial extensions have this issue.)
In iCagenda, it return to the list, with no display of events. or to a "no-event in the calendar" page.
(because id and itemid are protected and filtered)
To test a form again XSS vulnerabilities, just use a tool, as security compass XSS me Sidebar (in firefox)
It can pass 308 XSS attacks (virtualy), and in iCagenda, 0 attacks succeed !
If you test on a vulnerable form, it can add many entries in the database. I've tested this tool with registration form of iCagenda, but by removing the protection in my code, this tool is adding hundreds of new registered people! With the protection, no problem
Hope this explanation can be useful to all !
