[Sir Rusty]

Hello,

XtremeBB 0.1.1 is released.

Known bugs on XtremeBB 0.1.1:

- Footer (Forum Version doesnt change)

Additions to XtremeBB 0.1.1:

Upgrade Wizard [ADDED]

Bugs fixed:

cp.php? [Fixed]
Copyright link fixed.

----------------------

XtremeBB - A Free Forum Software based on PHP and SQL

[Oldiesmann]

I see a huge issue here...

else if (isset($_POST['confirm'])) {
	
	/**
	 * USer wants to delete, so proceed, then exit and return
	 */
	$post_id = $_POST['post_id'];
	
	$check_firstpost = mysql_fetch_array(mysql_query("SELECT COUNT(*) FROM ".MYSQL_TABLE_PREFIX."threads 
														WHERE thread_first_post_id='{$post_id}'"));

	if ($check_firstpost[0] != 0) {
		$get_post = mysql_fetch_array(mysql_query("SELECT * FROM ".MYSQL_TABLE_PREFIX."posts WHERE post_id='{$post_id}'"));
		//echo $get_post['post_belongs_to_thread'];
		mysql_query("DELETE FROM ".MYSQL_TABLE_PREFIX."threads 
					WHERE thread_id='{$get_post['post_belongs_to_thread']}'");
		
		mysql_query("DELETE FROM ".MYSQL_TABLE_PREFIX."posts 
					WHERE post_belongs_to_thread='{$get_post['post_belongs_to_thread']}'");
		
		
		
		echo mysql_error();
	}

As far as I can tell, there is absolutely no validation or security check prior to this code. This means a hacker can just create a form that posts to the page, and delete any thread they want, no questions asked.

There are several other problems here as well:
Using a SELECT * to pull the value from a single column
Relying on the ID of the first post in the thread to delete the thread rather than the thread ID
Echoing out mysql_error() without even checking to see if there was an error first

[Sir Rusty]

You mean theres no CAPTCHA when you post. On the ACP you could control who posts. And in 0.2.0 our main addition will be CAPTCHA ^_^!

[Oldiesmann]

Captcha has absolutely nothing to do this.

What's to stop me from creating a form like the one I mentioned above and posting a valid post ID to delete.php on your site and deleting any thread I want?

[Sir Rusty]

Owooo... I see. Okay, I will fix that then... We might not have the best security. I will try and do my best working on security on 0.2.0 ^_^!