CrackerTracker Exploit False Positives

[Teelk]

That is only for the "wheel of fortune MOD".

[Leadfoot]

actually psypru its for the game "wheel of forune" which is part of the amod arcade mod. Just so you are clear.

[ScottDaMan]

Couple false positives related to the qbar.
Script-Filename: /forum/admin/admin_qbar.php

Original:
$ct_ignorepvar = array('url');

New
$ct_ignorepvar = array('url','explain','shortcut');

Here's the debug details:

Code: Select all

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename]------------------------------------------#/forum/admin/admin_qbar.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('explain');

and

Code: Select all

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename]------------------------------------------#/forum/admin/admin_qbar.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('shortcut');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  

[Leadfoot]

Ok have the debug info and fix for cookie mod.

Code: Select all

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename: /forum/cookieMOD/cookie.php----------------  Request-Method: POST  Matching rule: _phpIn variable:   cookie_namePossible solution:------------------  ##-----[ OPEN ]------------------------------------------#/forum/cookieMOD/cookie.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('cookie_name');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  

That stopped the cracker tracker error for me.

[thatjoeguy]

I just tried modiying the Welcome PM through the ACP and got the CTracker warning. Put it into debug and found the possible fix, but it doesn't solve the probem.

The log says:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /admin/admin_wpm.php
----------------

Request-Method: POST

Matching rule: or
In variable: wpm_message

Matching rule: and
In variable: wpm_message

Matching rule: '
In variable: wpm_message

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/admin/admin_wpm.php

#
#-----[ FIND ]------------------------------------------
#
require('./pagestart.' . $phpEx);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('wpm_message');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

I didn't find:

require('./pagestart.' . $phpEx);

But instead found

require("pagestart.$phpEx");

and inserted the code after that, but it seems to have had no effect.

[Leadfoot]

I thought I would go try and see if I could debug it even farther joeguy. But I seemed to also run into other issues which I will put in another post. But try this it may work.

#
#-----[ OPEN ]------------------------------------------
#
/forum/admin/admin_wpm.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('wpm_message');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#

[BMD]

I just went to change the Welcoming PM and hit a CT issue

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /usr/local/apache/cgi-bin/php.cgi-4.3.1
----------------

Request-Method: POST

Matching rule: or
In variable: wpm_message

Matching rule: and
In variable: wpm_message

Matching rule: "
In variable: wpm_message

Matching rule: '
In variable: wpm_message

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/usr/local/apache/cgi-bin/php.cgi-4.3.1

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('wpm_message');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

I get how to edit the code... but I am on a paid host provider server and don't see the referenced path at all, and I believe they use linux

anyone got a clue?

also I already implemented Zack's patch

[tekguru]

Once these are all resolved with there be a definitive fix?

[JohnnyTheOne]

The following debug worked to me.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /home/profile.php
----------------

Request-Method: POST

Matching rule: delete
In variable: delete_user

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/profile.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('delete_user');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

[JohnnyTheOne]

end the following Warning: No ending delimiter '#' found in /var/www/vhosts/johnnytheone.com/httpdocs/home/ctracker/engines/ct_security.php on line 357

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /home/admin/admin_pa_ug_auth.php
----------------

Request-Method: GET

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/admin/admin_pa_ug_auth.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignoregvar = array('');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

[Leadfoot]

Ok one more for you guys

when trying to submit an update to navigation menu I would get ct warning when hitting submit on the edit.

here is the fix

Code: Select all

Script-Filename: /forum/admin/admin_qbar.php----------------  Request-Method: POST  Matching rule: load In variable:   explainPossible solution:------------------  ##-----[ OPEN ]------------------------------------------#/forum/admin/admin_qbar.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('explain');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM    

[sanji]

I can not add an administrator to my board: When going in User Admin -> Permissions, I get a false positive when submitting the name of a user.

OK, I have not find how to solve the problem yet...

sanji

[Pogue Moran]

Can anyone help me fix a false positive? I'm trying to get the inline quickediting function of Ajax but I keep getting a false positive everytime I try to save the edit what do I need to do to fix this?

Below is the install file

[url=http]Ajaxed Install Instruction[/url]

[fish222222]

I get false positives on just about everything I do, even with all of the security turned off. I just put 1.4.0 back on and called it good. Too many issues to deal with to mess with it.

[Khoas]

Adding a banner:

Code: Select all

Possible solution]------------------------------------------#/forum/admin/admin_banner.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('banner_name');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM