Notice: ABPro's Stripe payment processor uses the Legacy Checkout and is not SCA compatible. read more..

Welcome, Guest
Username: Password: Remember me
Keyword

TOPIC: Fix for posted vulnerablity

Fix for posted vulnerablity 2 years 6 months ago #23009

  • Rob
  • Rob's Avatar
  • Offline
  • Administrator
  • Posts: 4437
  • Thank you received: 630
  • Karma: 95
In late February 2017 a hacker database site posted a vulnerability of ABPro.

This will address that vulnerability.


Edit file: \administrator\components\com_rsappt_pro3\sendmail_pro2.php

Around line 1116 (ABPro 4.x) or 1086 (ABPro 3.0.6) look for:
$sql = 'SELECT count(*) FROM #__sv_apptpro3_requests WHERE id_requests = '. $request_id.' AND cancellation_id ="'. $cc.'"';

Change to:
$sql = 'SELECT count(*) FROM #__sv_apptpro3_requests WHERE id_requests = '.$database->escape($request_id).' AND cancellation_id ="'.$database->escape($cc).'"';


Edit file: \components\com_rsappt_pro3\rsappt_pro3.php

At line 63 inset red code

//set the controller page
if (!file_exists(JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php' )){
echo "Invalid ABPro controller specified";
exit;
}

require_once (JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php');

Note: This fix is to stop a hacker from taking advantage of the published vulnerability and has only had basic testing to verify it has no detrimental effect to the operation of ABPro. If you encounter operation issues after implementing this, please email me with details.
Last Edit: 2 years 6 months ago by Rob.
The topic has been locked.
Time to create page: 0.229 seconds
Powered by Kunena Forum

Only Official ABPro site

This is the one and only official site for Appointment Booking Pro.

If you downloaded ABPro anywhere else, you are not supporting ABPro's future. 
Help ensure Appointment Booking Pro is available for you next month and next year.
Support this site. 

Just thought I'd pass along some positive feedback from my client:
"All of us are excited about our new online booking!! Shanyn & Chelsea said it’s “fun”; even I’m getting the hang of it!  There are still a few glitches so we’re having another meeting on Tuesday - but all of us are thrilled!  Thank you! Thank you!"

The "glitches" they mentioned are all minor and I've tweaked a few settings and answered a few questions to address them. Overall they're very happy. "
Chris C


"Hi, im back 
 After using appbooking pro for 3 years successfully i have tried another booking system for a new site that was more expensive, promised a lot but full of errors and the developers wanted to suck the $$ for every little request.

Anyways, great to be back here "
roll82


"thanks for all the help you have given me over the past few months. We have managed to get the system to work so that multiple businesses around the country can log into our website and manage appointments for their own businesses through the ABPro System."

owen_molloy October 2013


Just thought I'd pass along some positive feedback from my client:
"All of us are excited about our new online booking!! Shanyn & Chelsea said it’s “fun”; even I’m getting the hang of it!  There are still a few glitches so we’re having another meeting on Tuesday - but all of us are thrilled!  Thank you! Thank you!"

The "glitches" they mentioned are all minor and I've tweaked a few settings and answered a few questions to address them. Overall they're very happy. "
Chris C


"Hi, im back 
 After using appbooking pro for 3 years successfully i have tried another booking system for a new site that was more expensive, promised a lot but full of errors and the developers wanted to suck the $$ for every little request.

Anyways, great to be back here "
roll82


"thanks for all the help you have given me over the past few months. We have managed to get the system to work so that multiple businesses around the country can log into our website and manage appointments for their own businesses through the ABPro System."

owen_molloy October 2013


Just thought I'd pass along some positive feedback from my client:
"All of us are excited about our new online booking!! Shanyn & Chelsea said it’s “fun”; even I’m getting the hang of it!  There are still a few glitches so we’re having another meeting on Tuesday - but all of us are thrilled!  Thank you! Thank you!"

The "glitches" they mentioned are all minor and I've tweaked a few settings and answered a few questions to address them. Overall they're very happy. "
Chris C


"Hi, im back 
 After using appbooking pro for 3 years successfully i have tried another booking system for a new site that was more expensive, promised a lot but full of errors and the developers wanted to suck the $$ for every little request.

Anyways, great to be back here "
roll82


"thanks for all the help you have given me over the past few months. We have managed to get the system to work so that multiple businesses around the country can log into our website and manage appointments for their own businesses through the ABPro System."

owen_molloy October 2013


Just thought I'd pass along some positive feedback from my client:
"All of us are excited about our new online booking!! Shanyn & Chelsea said it’s “fun”; even I’m getting the hang of it!  There are still a few glitches so we’re having another meeting on Tuesday - but all of us are thrilled!  Thank you! Thank you!"

The "glitches" they mentioned are all minor and I've tweaked a few settings and answered a few questions to address them. Overall they're very happy. "
Chris C


"Hi, im back 
 After using appbooking pro for 3 years successfully i have tried another booking system for a new site that was more expensive, promised a lot but full of errors and the developers wanted to suck the $$ for every little request.

Anyways, great to be back here "
roll82


"thanks for all the help you have given me over the past few months. We have managed to get the system to work so that multiple businesses around the country can log into our website and manage appointments for their own businesses through the ABPro System."

owen_molloy October 2013


Just thought I'd pass along some positive feedback from my client:
"All of us are excited about our new online booking!! Shanyn & Chelsea said it’s “fun”; even I’m getting the hang of it!  There are still a few glitches so we’re having another meeting on Tuesday - but all of us are thrilled!  Thank you! Thank you!"

The "glitches" they mentioned are all minor and I've tweaked a few settings and answered a few questions to address them. Overall they're very happy. "
Chris C


"Hi, im back 
 After using appbooking pro for 3 years successfully i have tried another booking system for a new site that was more expensive, promised a lot but full of errors and the developers wanted to suck the $$ for every little request.

Anyways, great to be back here "
roll82


"thanks for all the help you have given me over the past few months. We have managed to get the system to work so that multiple businesses around the country can log into our website and manage appointments for their own businesses through the ABPro System."

owen_molloy October 2013


Just thought I'd pass along some positive feedback from my client:
"All of us are excited about our new online booking!! Shanyn & Chelsea said it’s “fun”; even I’m getting the hang of it!  There are still a few glitches so we’re having another meeting on Tuesday - but all of us are thrilled!  Thank you! Thank you!"

The "glitches" they mentioned are all minor and I've tweaked a few settings and answered a few questions to address them. Overall they're very happy. "
Chris C


"Hi, im back 
 After using appbooking pro for 3 years successfully i have tried another booking system for a new site that was more expensive, promised a lot but full of errors and the developers wanted to suck the $$ for every little request.

Anyways, great to be back here "
roll82


"thanks for all the help you have given me over the past few months. We have managed to get the system to work so that multiple businesses around the country can log into our website and manage appointments for their own businesses through the ABPro System."

owen_molloy October 2013


Just thought I'd pass along some positive feedback from my client:
"All of us are excited about our new online booking!! Shanyn & Chelsea said it’s “fun”; even I’m getting the hang of it!  There are still a few glitches so we’re having another meeting on Tuesday - but all of us are thrilled!  Thank you! Thank you!"

The "glitches" they mentioned are all minor and I've tweaked a few settings and answered a few questions to address them. Overall they're very happy. "
Chris C


"Hi, im back 
 After using appbooking pro for 3 years successfully i have tried another booking system for a new site that was more expensive, promised a lot but full of errors and the developers wanted to suck the $$ for every little request.

Anyways, great to be back here "
roll82


"thanks for all the help you have given me over the past few months. We have managed to get the system to work so that multiple businesses around the country can log into our website and manage appointments for their own businesses through the ABPro System."

owen_molloy October 2013


Just thought I'd pass along some positive feedback from my client:
"All of us are excited about our new online booking!! Shanyn & Chelsea said it’s “fun”; even I’m getting the hang of it!  There are still a few glitches so we’re having another meeting on Tuesday - but all of us are thrilled!  Thank you! Thank you!"

The "glitches" they mentioned are all minor and I've tweaked a few settings and answered a few questions to address them. Overall they're very happy. "
Chris C


"Hi, im back 
 After using appbooking pro for 3 years successfully i have tried another booking system for a new site that was more expensive, promised a lot but full of errors and the developers wanted to suck the $$ for every little request.

Anyways, great to be back here "
roll82


"thanks for all the help you have given me over the past few months. We have managed to get the system to work so that multiple businesses around the country can log into our website and manage appointments for their own businesses through the ABPro System."

owen_molloy October 2013