whizzy vulnerability

[caeos]

is "tp" affected by this and can i delete the whizzy diretory without harm just in case?

[Nokonium]

Do pardon what?

[caeos]

http://www.frsirt.com/english/advisories/2007/1136

Multiple vulnerabilities have been identified in aBitWhizzy, which could be exploited by attackers to gain knowledge of sensitive information or execute arbitrary scripting code. These issues are due to input validation errors in the "whizzylink.php", "whizzypic.php", "whizzery/whizzypic.php" and "whizzery/whizzylink.php" scripts that do not validate the "d" parameter, which could be exploited by attackers to disclose the installation path and list the contents of arbitrary directories, or cause arbitrary scripting code to be executed by the user's browser in the security context of an affected Web site.[/unquote]

[IchBin]

You should be able to delete the directory until you hear from Bloc about this. I'll forward this info to him so he can check on this.

[caeos]

thank you, didnt really want my first actual post to be a scary one !

[Dazed]

You should be able to delete the directory until you hear from Bloc about this. I'll forward this info to him so he can check on this.

IchBin I think Bloc mentioned this before upgrading to .983. I can't seem to find the post here now but I know it related to a text editor and, I believe, it is that one. Of Course I have no idea if it was fixed or not...

[bloc]

Whizzywig had indeed issues with security in the Whizzypic.php. In TP 0.9.8 that file was changed to no longer using the "d" from the query. Instead it uses the SMF internal values. It cannot be run on its own either, like before.

So you can keep the whizzypic.php if you wish..or just remove it if you rather want to be 100% safe.

[caeos]

thank you - i have already removed the directory after renaming it. i did get some hits on the whizzy alone so thought it would be best to just stay with the default editor.

[hartiberlin]

For what is this whizzypic.php used ?
Can I savely delete it ?
I found some poker.html files in the
upload directory beneath it and my site was probably hacked via it...
So what is it used for in TinyPortal ?

Can I just these the whole
wysiwyg
directory where it was located in my case ?

Many thanks..

[bloc]

You can remove it yes, and the wysiwyg folder if you are not using Whizzywig as an editor.