View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0000217Main CAcert Websitesource codepublic2006-04-25 20:532013-11-20 22:23
Reporteraanriot Assigned To 
PrioritynormalSeverityminorReproducibilityalways
Status closedResolutionfixed 
Fixed in Version2006 
Summary0000217: remove old functionality for CSR
Descriptionaccount.php?id=45 and id=46 implement the same functionality as id=10 and id=11. As they are using the same session variables but different verification methods and a different implementation this may lead to unforseen behaviour of the site.

Currently I see no possible exploit but it should be possible to use id=45 to initialise $_SESSION['_config']['0.CN'] and then use id=11 to process a not existing the CSR file, circumventing

  if($_SESSION['_config']['0.CN'] == "" [...]
                {
                        [...]
                        exit;
                }


Recommendation: id=45 and id=46 should be removed as they are not used anyway. At least block access for normal users.
TagsNo tags attached.
Reviewed by
Test Instructions

Activities

duane

2006-08-14 16:11

developer   ~0000454

line 22:

        if($id == 45 || $id == 46 || $oldid == 45 || $oldid == 46)
        {
                $id = 1;
                unset($oldid);
        }

Issue History

Date Modified Username Field Change
2006-04-25 20:53 bluec New Issue
2006-08-14 16:10 duane Status new => needs work
2006-08-14 16:10 duane Assigned To => bluec
2006-08-14 16:11 duane Status needs work => solved?
2006-08-14 16:11 duane Fixed in Version => production
2006-08-14 16:11 duane Resolution open => fixed
2006-08-14 16:11 duane Note Added: 0000454
2007-10-24 06:17 evaldo Reporter bluec => aanriot
2007-10-24 06:17 evaldo Assigned To bluec =>
2007-10-24 06:17 evaldo Status solved? => closed
2013-01-14 08:12 Werner Dworak Fixed in Version => 2006
2013-11-20 22:23 NEOatNHNG View Status private => public