Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Multiple SQL injection-, reflecting/stored XSS- and CSRF-vulnerabilities in phpBugTracker v. 1.6.0 #4

Closed
ghost opened this issue Feb 5, 2015 · 5 comments
Assignees

Comments

@ghost
Copy link

ghost commented Feb 5, 2015

Dear development team.

I found multiple SQL injection-, reflecting/stored XSS- and CSRF-vulnerabilities in your product phpBugTracker v.1.6.0.

Please provide me an email-address where I can send the technical details to. Otherwise, if you don't mind, I can post them directly on Github.

I have released a security advisory without technical details here: http://sroesemann.blogspot.de/2015/02/sroeadv-2015-16.html.

If you don't respond until 19th February 2015 (UTC+1), I will as well release the technical details of these issues and send the vulnerabilities to the security mailing list FullDisclosure, to warn people.

Thank you for your attention.

Greetings from Germany.

Steffen Rösemann

@a-v-k
Copy link
Owner

a-v-k commented Feb 5, 2015

Hello, Steffen!
Thank you for inspection of phpBugTracker.
We are really have many security vulnerabilities, inherited from old developer. I have already fix a lot of them. But I need assistance to find all of them.
Now together we can make the the world a better :)

I will send copy of this message to your email to provide you my email address.

@ghost
Copy link
Author

ghost commented Feb 6, 2015

Hi.

Just have sent you the technical details.

Greetings.

Steffen Rösemann

@a-v-k
Copy link
Owner

a-v-k commented Feb 9, 2015

New version 1.7.0 includes fixes for all security vulnerabilities, found by Steffen Rösemann.

@a-v-k a-v-k closed this as completed Feb 10, 2015
@a-v-k a-v-k self-assigned this Feb 10, 2015
@ghost
Copy link
Author

ghost commented Feb 19, 2015

As we agreed, I just have released the technical details of these issues (see http://sroesemann.blogspot.de/2015/02/sroeadv-2015-16.html) and send them to the security mailing list FullDisclosure. If any CVE-IDs will be assigned for these issues, I will inform you here.

Thank you for the good collaboration.

Greetings from Germany.

Steffen Rösemann

@ghost
Copy link
Author

ghost commented Feb 28, 2015

Hi. :-)

To end this correctly, I'd like to inform you, that these issues (and issues you found yourself) have been assigned multiple CVE-identifiers by MITRE. Please see here for further details: http://seclists.org/oss-sec/2015/q1/704

Thank you!

Greetings!

Steffen Rösemann

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant