Welcome to Geeklog, Anonymous Monday, December 08 2025 @ 02:40 am EST

Comments for So-called Geeklog "exploit" posted

So-called Geeklog "exploit" posted | 9 comments | Create New Account

The following comments are owned by whomever posted them. This site is not responsible for what they say.

So-called Geeklog "exploit" posted

Authored by: socalledsoftware on Saturday, July 01 2006 @ 05:55 am EDT

You know, the fact that this is being downplayed as a "so-called" exploit really shows your ego and arrogance. If it's a "so-called" exploit, why was it "fixed"? It's anything but "so-called", exploits do in fact exist for numerous php files (the ones I'm referring to are the SpamX plugin related vulnerable php files. The ones that are easily exploitable).

Now, I hear you saying you are relying on the user to follow through with the guidelines in the documentation for where to place the files (outside of their webroot). If a user were to follow these instructions, then gee ok garsh you win, it's not exploitable, because the files can't be accessed remotely. However, as a software developer, it is frightening to know that your stance is that vulnerable code isn't a threat, because 100% of the time 100% of the users will follow 100% of the documentation.

Don't be fooled by a "so-called" exploit, it is quite real, and is actively being used to compromise servers. The only thing "so-called" here is the quality of any PHP scripts that have remote include vulnerabilities such as the ones contained in the numerous files that are part of the SpamX plugin. What year is this? 2006? And people are STILL making this stupid coding mistake? And on top of that trying to downplay the threat? Suck it up - the code sucked, the QAing of the code (if any even took place) sucked, and the labeling of a vulnerability that uses such an old class of bugs as anything other than critical sucks.

It's disheartening to see such arrogance, and even moreso to think that people are going to be getting owned because Geeklog said it was only a "so-called" exploit. Vulnerable code is vulnerable code, period. You make it sound as if it would be perfectly acceptable for vulnerable code to be put into use as long as it's not remotely accessible. You are not thinking like a user, just a crappy software developer whos pride just took a fat punch in the nose. Get over it, it happens.

So-called Geeklog "exploit" posted

Authored by: casper on Saturday, July 01 2006 @ 06:48 am EDT

If a user dont install even proper code the way it was intended to be used, even this could be "potentialy" dangerous.
If the user socalledsoftware had NOT been a script-kiddie (you can se it by the arrogant way he expresses himself), but a software developer as he claims he had known what "outside webroot" means. Thats where that script are supposed to be placed. And am I the only one who have noticed all warnings about unsecure site if all dirs are placed within the webroot? I dont think so..
Please dont mention "novice users", if you dont know what you are doing, even drinking a glass of cold milk will kill you.

---
LAMP? Mine is -> WIMP

So-called Geeklog "exploit" posted

Authored by: Dirk on Saturday, July 01 2006 @ 03:30 pm EDT

It certainly was sloppy QA, considering that we already had these checks in some other places. But then again, they are only there to somehow protect those from themselves that didn't follow the installation instructions.

I still refuse to call it an exploit, though. It's an "exploit" in pretty much the same way that it's an "exploit" when your PC is hacked because you didn't activate your firewall.

bye, Dirk

So-called Geeklog "exploit" posted

Authored by: andyofne on Sunday, July 02 2006 @ 02:36 am EDT

I have to admit that, at least in my case, I did not follow the instructions from day one and every time I re-installed or updated GL I did it wrong. I choose to modify the way I did the install and I paid the price for not following the directions. Quoted below is the part I ignored. I put the files in the web root and did not protect them.

[b]Basically, a Geeklog installation consists of two parts: The part that is visible "to the world" - which is everything in the public_html directory. "public_html" is a popular name for the world-accessible directory that can be found on a webserver ("htdocs" and "www" are other popular names). So if you have such a directory, just copy everything from Geeklog's public_html directory into that directory on your webserver. Then you only need to set up $_CONF['path_html'] (in config.php) to point to that directory.[/b]

Search

Resources

About

Getting started

Support

Development

Topics

User Functions

What's New

Articles last 4 weeks

Comments last 4 weeks

Pages last 4 weeks

Links last 4 weeks

Downloads last 4 weeks