Configuration Gesior AAC Exploits! [All Versions]

[MxSoft]

why not focus on dropping POT and cleaning up the few remaining scripts, it might still have some potential

bug tracker is "sort of" an exploit because it doesn't use htmlspecialchars for some fields

You already have developed a acc without pot isnt it?

 

[digo1040]

Solution for latestnews.php - Ticker Bug:
In the config/config.php add this:

$config['site']['access_tickers'] = 3; // access level needed to edit ticker

Sorry to revive the topic, but many people have this problem!

 

[Red]

Solution for latestnews.php - Ticker Bug:
In the config/config.php add this:

$config['site']['access_tickers'] = 3; // access level needed to edit ticker

Sorry to revive the topic, but many people have this problem!

If I'm not mistaken, there was a way around this..

Red

 

[GODPaaulo]

OMG!
I never imagined that Gesior had several exploits so, but from what I see, is missing a few to add to list

 

[Lanceq2]

nice !

 

[Roinujz]

thank you!

 

[Tibiamakers]

and remove webdav file in xampp folder, don't know how people can upload shells and modify your database, maybe houses or guild logo

 

[row900]

Notice: Undefined index: page in C:\xampp\htdocs\install.php on line 40

Notice: Undefined index: page in C:\xampp\htdocs\install.php on line 52

Notice: Undefined index: page in C:\xampp\htdocs\install.php on line 63

 

[Tony32]

- The PHP GIF security issue

The problem that was discovered is that you can insert PHP code in the middle of a GIF image. That would not be a problem if it was not for the insecure ways some developers use to serve images upload by their users.

Usually, uploaded files are moved to a given directory. If the site then serves the images directly from that directory and preserve the original file name, the site may be open for security exploits.

For instance, lets say the attacker uploads an image named image.gif.php . The image may be moved to the images directory. If the the Web server is configured as usual to process requests with files .php extension, and the site serves the image with the following URL, the request will execute the PHP code inside the image.

http://www.yoursite.com/images/image.gif.php

This is fixed? I can't upload any files with asdasd.gif.php as extension on my site?