Vulnerabilities

Can someone confirm or deny this (get it from my friend who is a hosting server admin):

New Advisory:
modx-0.9.6
http://www.dear-pets.com
——————–Summary—————-
Software: modx-0.9.6
Sowtware’s Web Site: http://www.modxcms.com
Versions: 0.9.6
Critical Level: Moderate
Type: Multiple Vulnerabilities
Class: Remote
Status: Unpatched
PoC/Exploit: Not Available
Solution: Not Available
Discovered by: http://www.dear-pets.com
—————–Description—————
1. SQL Injection.
Vulnerable script: mutate_content.dynamic.php
Parameters ‘documentDirty’, ‘modVariables’ is not
properly sanitized before being used in SQL query. This can be used to
make SQL queries by injecting arbitrary SQL code.

Condition: magic_quotes_gpc = off
————–PoC/Exploit———————-
Waiting for developer(s) reply.
————–Solution———————
No Patch available.
————–Credit———————–
Discovered by: http://www.dear-pets.com

documentDirty is a Javascript variable, used to determine if changes have been made in any of the form fields in the client before the form is submitted. What does it have to do with sql queries?

modVariables doesn’t even occur in the file at all.

And where is this advisory?

I can confirm that this is absolutely not a vulnerability in any way, shape or form.

I get this as a response from my host admin:

[email protected](/host/imandic.com/sites/gridkg.com)# grep -R modVariables *
httpdocs/manager/actions/mutate_content.dynamic.php:var modVariables = [];
httpdocs/manager/actions/mutate_content.dynamic.php: var i, isDirty, mv = modVariables;

The whole story is that he wants me to abandon MODx and start using Drupal, and I’m fighting back...Love MODx..

Well, in any case, those are Javascript variables and have nothing at all to do with any sql queries.

Maybe a bit of javascript that has been removed; I was looking at the file from the latest 0.9.6.1 from SVN.

Quote from: imandic at Oct 09, 2007, 05:19 PM

The whole story is that he wants me to abandon MODx and start using Drupal, and I’m fighting back...Love MODx..

Sounds like said host plays favorites. 

Trying to find a miniscule thing like that, and not even checking to see if it really even exists.

I don’t know who the reporters are yet, but you can bet they are getting a piece of my mind for this bogus security report which is now taking up half of my day to deal with...
>:(

This is definitely a completely bogus report (unlike some of the ones below for Drupal):
http://search.securityfocus.com/swsearch?sbm=%2F&metaname=alldoc&query=drupal&x=0&y=0
http://osvdb.org/searchdb.php?action=search_title&vuln_title=drupal&Search=Search

The dear-pets.com guy is probably a script kiddie who thinks he’s a programmer. Posts in the vulnerability site and never even mentions it to anybody from MODx. Just looking at the message, you can see those are Javascript variables, not parameters and nothing to do with PHP or SQL.

(well, I suppose I knew that because I already know that’s what they are... but if you look at the code in question, it’s obvious.)

Oh, great. It was even been posted to SecurityFocus. If I wasn’t suspecting sheer stupidity, I’d be thinking somebody was deliberately trying to spread FUD about MODx!