Jamroom Logo   Get Jamroom now for as low as $19!
The Powerful Social Media Platform
 Jamroom Support Forum Log in »  Forum Search »
** Important Notice for Jamroom 3.2.x sites! **  Previous topic  Next topic 
bigguy
Jamroom Team


Joined: 09 Jul 2003
Posts: 34857
Location: Seattle, WA

Posted: 06/22/08 16:30 
After further analysis of Jamroom 3.2.x, it appears that the following file could be vulnerable to the Remote File Inclusion vulnerability that I thought was only in 3.3.x:

jamroom/include/plugins/jrBrowser/purchase.php

If you are running any version of Jamroom 3.2.x, and have the Jamroom Payment Pack installed, do the following:

- log into Jamroom as the Master Admin
- click on Jamroom Tools -> Server Check -> Click here for detailed PHP Information
- scroll down to the register_globals setting on the left - if the value says On then you need to DELETE the file:

jamroom/include/plugins/jrBrowser/purchase.php

OR

modify the file and change this:


Code

#-----------------------------------------------------------------------
# $Id: purchase.php,v 1.1.2.3 2008-01-08 22:53:03 bigguy Exp $
#-----------------------------------------------------------------------
require_once("{$jamroom['jm_dir']}/include/jamroom-payment.inc.php");


to this:


Code

#-----------------------------------------------------------------------
# $Id: purchase.php,v 1.1.2.3 2008-01-08 22:53:03 bigguy Exp $
#-----------------------------------------------------------------------
defined('IN_JAMROOM') or exit();
require_once("{$jamroom['jm_dir']}/include/jamroom-payment.inc.php");


That will protect your site from the attack.

This has been fixed in Jamroom 3.3.6, so updating to Jamroom 3.3.6 will also fix this issue.

If you have any questions, please let me know.

Thanks!

- Brian


_________________
Make sure and check out:
* The Jamroom FAQ
* The Jamroom Documentation
Back to top
Display posts from previous:   
Page 1 of 1

 
Jump to:  
Home | Download | Support | FAQ | Demos | Members | Purchase | Marketplace | Contact | Privacy
Forum by phpBB © 2001, 2005 phpBB Group
©2003 - 2009 Talldude Networks, LLC.