Fix for posted vulnerablity

  • Rob
  • Rob's Avatar Topic Author
  • Offline
  • Administrator
  • Administrator
More
5 years 8 months ago - 5 years 8 months ago #23009 by Rob
Fix for posted vulnerablity was created by Rob
In late February 2017 a hacker database site posted a vulnerability of ABPro.

This will address that vulnerability.


Edit file: \administrator\components\com_rsappt_pro3\sendmail_pro2.php

Around line 1116 (ABPro 4.x) or 1086 (ABPro 3.0.6) look for:
$sql = 'SELECT count(*) FROM #__sv_apptpro3_requests WHERE id_requests = '. $request_id.' AND cancellation_id ="'. $cc.'"';

Change to:
$sql = 'SELECT count(*) FROM #__sv_apptpro3_requests WHERE id_requests = '.$database->escape($request_id).' AND cancellation_id ="'.$database->escape($cc).'"';


Edit file: \components\com_rsappt_pro3\rsappt_pro3.php

At line 63 inset red code

//set the controller page
if (!file_exists(JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php' )){
echo "Invalid ABPro controller specified";
exit;
}

require_once (JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php');

Note: This fix is to stop a hacker from taking advantage of the published vulnerability and has only had basic testing to verify it has no detrimental effect to the operation of ABPro. If you encounter operation issues after implementing this, please email me with details.
Last edit: 5 years 8 months ago by Rob.
The topic has been locked.
Time to create page: 0.138 seconds
Powered by Kunena Forum

Just thought I'd pass along some positive feedback from my client:
"All of us are excited about our new online booking!! Shanyn & Chelsea said it’s “fun”; even I’m getting the hang of it!  There are still a few glitches so we’re having another meeting on Tuesday - but all of us are thrilled!  Thank you! Thank you!"

The "glitches" they mentioned are all minor and I've tweaked a few settings and answered a few questions to address them. Overall they're very happy. "
Chris C


"Hi, im back 
 After using appbooking pro for 3 years successfully i have tried another booking system for a new site that was more expensive, promised a lot but full of errors and the developers wanted to suck the $$ for every little request.

Anyways, great to be back here "
roll82


"thanks for all the help you have given me over the past few months. We have managed to get the system to work so that multiple businesses around the country can log into our website and manage appointments for their own businesses through the ABPro System."

owen_molloy October 2013


Just thought I'd pass along some positive feedback from my client:
"All of us are excited about our new online booking!! Shanyn & Chelsea said it’s “fun”; even I’m getting the hang of it!  There are still a few glitches so we’re having another meeting on Tuesday - but all of us are thrilled!  Thank you! Thank you!"

The "glitches" they mentioned are all minor and I've tweaked a few settings and answered a few questions to address them. Overall they're very happy. "
Chris C


"Hi, im back 
 After using appbooking pro for 3 years successfully i have tried another booking system for a new site that was more expensive, promised a lot but full of errors and the developers wanted to suck the $$ for every little request.

Anyways, great to be back here "
roll82


"thanks for all the help you have given me over the past few months. We have managed to get the system to work so that multiple businesses around the country can log into our website and manage appointments for their own businesses through the ABPro System."

owen_molloy October 2013


Just thought I'd pass along some positive feedback from my client:
"All of us are excited about our new online booking!! Shanyn & Chelsea said it’s “fun”; even I’m getting the hang of it!  There are still a few glitches so we’re having another meeting on Tuesday - but all of us are thrilled!  Thank you! Thank you!"

The "glitches" they mentioned are all minor and I've tweaked a few settings and answered a few questions to address them. Overall they're very happy. "
Chris C


"Hi, im back 
 After using appbooking pro for 3 years successfully i have tried another booking system for a new site that was more expensive, promised a lot but full of errors and the developers wanted to suck the $$ for every little request.

Anyways, great to be back here "
roll82


"thanks for all the help you have given me over the past few months. We have managed to get the system to work so that multiple businesses around the country can log into our website and manage appointments for their own businesses through the ABPro System."

owen_molloy October 2013


Just thought I'd pass along some positive feedback from my client:
"All of us are excited about our new online booking!! Shanyn & Chelsea said it’s “fun”; even I’m getting the hang of it!  There are still a few glitches so we’re having another meeting on Tuesday - but all of us are thrilled!  Thank you! Thank you!"

The "glitches" they mentioned are all minor and I've tweaked a few settings and answered a few questions to address them. Overall they're very happy. "
Chris C


"Hi, im back 
 After using appbooking pro for 3 years successfully i have tried another booking system for a new site that was more expensive, promised a lot but full of errors and the developers wanted to suck the $$ for every little request.

Anyways, great to be back here "
roll82


"thanks for all the help you have given me over the past few months. We have managed to get the system to work so that multiple businesses around the country can log into our website and manage appointments for their own businesses through the ABPro System."

owen_molloy October 2013


Just thought I'd pass along some positive feedback from my client:
"All of us are excited about our new online booking!! Shanyn & Chelsea said it’s “fun”; even I’m getting the hang of it!  There are still a few glitches so we’re having another meeting on Tuesday - but all of us are thrilled!  Thank you! Thank you!"

The "glitches" they mentioned are all minor and I've tweaked a few settings and answered a few questions to address them. Overall they're very happy. "
Chris C


"Hi, im back 
 After using appbooking pro for 3 years successfully i have tried another booking system for a new site that was more expensive, promised a lot but full of errors and the developers wanted to suck the $$ for every little request.

Anyways, great to be back here "
roll82


"thanks for all the help you have given me over the past few months. We have managed to get the system to work so that multiple businesses around the country can log into our website and manage appointments for their own businesses through the ABPro System."

owen_molloy October 2013


Just thought I'd pass along some positive feedback from my client:
"All of us are excited about our new online booking!! Shanyn & Chelsea said it’s “fun”; even I’m getting the hang of it!  There are still a few glitches so we’re having another meeting on Tuesday - but all of us are thrilled!  Thank you! Thank you!"

The "glitches" they mentioned are all minor and I've tweaked a few settings and answered a few questions to address them. Overall they're very happy. "
Chris C


"Hi, im back 
 After using appbooking pro for 3 years successfully i have tried another booking system for a new site that was more expensive, promised a lot but full of errors and the developers wanted to suck the $$ for every little request.

Anyways, great to be back here "
roll82


"thanks for all the help you have given me over the past few months. We have managed to get the system to work so that multiple businesses around the country can log into our website and manage appointments for their own businesses through the ABPro System."

owen_molloy October 2013


Just thought I'd pass along some positive feedback from my client:
"All of us are excited about our new online booking!! Shanyn & Chelsea said it’s “fun”; even I’m getting the hang of it!  There are still a few glitches so we’re having another meeting on Tuesday - but all of us are thrilled!  Thank you! Thank you!"

The "glitches" they mentioned are all minor and I've tweaked a few settings and answered a few questions to address them. Overall they're very happy. "
Chris C


"Hi, im back 
 After using appbooking pro for 3 years successfully i have tried another booking system for a new site that was more expensive, promised a lot but full of errors and the developers wanted to suck the $$ for every little request.

Anyways, great to be back here "
roll82


"thanks for all the help you have given me over the past few months. We have managed to get the system to work so that multiple businesses around the country can log into our website and manage appointments for their own businesses through the ABPro System."

owen_molloy October 2013


Just thought I'd pass along some positive feedback from my client:
"All of us are excited about our new online booking!! Shanyn & Chelsea said it’s “fun”; even I’m getting the hang of it!  There are still a few glitches so we’re having another meeting on Tuesday - but all of us are thrilled!  Thank you! Thank you!"

The "glitches" they mentioned are all minor and I've tweaked a few settings and answered a few questions to address them. Overall they're very happy. "
Chris C


"Hi, im back 
 After using appbooking pro for 3 years successfully i have tried another booking system for a new site that was more expensive, promised a lot but full of errors and the developers wanted to suck the $$ for every little request.

Anyways, great to be back here "
roll82


"thanks for all the help you have given me over the past few months. We have managed to get the system to work so that multiple businesses around the country can log into our website and manage appointments for their own businesses through the ABPro System."

owen_molloy October 2013