Has this bug been patched Arbitrary PHP code execution in modx 1.0.0

222 Posts

stargatesg1 Reply #1, 16 years, 11 months ago

Came accross the following URL

http://heine.familiedeelstra.com/modx-arbitrary-code-execution

MODX Staff
10,725 Posts

opengeek Reply #2, 16 years, 11 months ago

I can’t access that URL...

Jason Coward
Chief Architect @ MODX
http://www.jasoncoward.com | http://twitter.com/drumshaman | https://github.com/opengeek

222 Posts

stargatesg1 Reply #3, 16 years, 11 months ago

This was actually discussed in this post.

http://modxcms.com/forums/index.php?topic=39691.0

MODX Staff
12,272 Posts

Ryan Thrash Reply #4, 16 years, 11 months ago

If you enable the option in the manager and tweak the regex per that thread to check referrers it should be addressed. We’re making a new release with this enabled by default and an additional config warning in the manager if it’s disabled soon as version 1.0.1.

Ryan Thrash, MODX Co-Founder
Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me