forum.coppermine-gallery.net

Support => cpg1.5.x Support => cpg1.5 miscellaneous => Topic started by: roberb7 on May 11, 2017, 01:20:14 am

Title: Serious security issue with search function
Post by: roberb7 on May 11, 2017, 01:20:14 am

This is for version 1.5.46.
My site is hosted by Veerotech.
This morning, I attempted to search for a picture. After I did so, all accesses to my entire site (not just the coppermine directory) resulted in 403 errors.
After checking the usual culprits (.htaccess, directory permissions), I contacted Veerotech's support. What I learned is my site was blocked the Mod_Security rules. The only info they were able to give me was, "likely a poorly coded plugin/module allowing variables to be submitted in a similar fashion to XSS."
I wish they could have been more specific, but the problem they refer to would be in search.php or thumbnails.php. Probably the former.

Title: Re: Serious security issue with search function
Post by: Αndré on July 03, 2017, 03:22:17 pm

That's the first report regarding that issue. I doubt we can do anything without more details how to replicate the issue.