Bug Username change item can be exploited

[DragonByte Technologies]

Hello Jeremy,

This ticket has now been closed with the status Cannot Reproduce.

We hope your issue or question has been addressed to your satisfaction. If not, please feel free to re-open it by clicking this link.

If you have any further issues or questions, please feel free to start a new support ticket via the button at the top of every page.

Thank you!

 

[Jeremy]

Did you try the way I was able to reproduce it? It seemed to work pretty easily and instantly most of the time, so I was just wondering since I wasn't able to try it on another forum. I just don't see how it could act differently on my forum only.

 

[Fillip H.]

I did, and I just tried it again and I'm unable to replicate this issue, sorry

If this was a common problem, chances are we'd have more reports of this issue happening at any point over the years.

 

[Jeremy]

Just curious, how does it determine if the item can't be configured again? At first I thought it was if the dbtech_vbshop_purchase row had something in the configuration column, but I guess that's not it. Thanks.

 

[Fillip H.]

Just curious, how does it determine if the item can't be configured again? At first I thought it was if the dbtech_vbshop_purchase row had something in the configuration column, but I guess that's not it. Thanks.

If the configuration column is something other than NULL, it's considered configured.

 

[Jeremy]

That's what I figured at first, but this is from testing on my test forum.

This is the row in the database:

This is my account's (userid 1) inventory, the item at the bottom is the item (featureid 16).

 

[Fillip H.]

Are you sure re-configuration is not enabled on that item?

 

[Jeremy]

Are you sure re-configuration is not enabled on that item?

Yes

 

[Fillip H.]

I'll need access to that account as well as an FTP account in order to look into this further.

 

[Jeremy]

Okay, I will PM it to you.

 

[Fillip H.]

The problem is that the serialized code is invalid. It says the string "test123" is 9 characters long, which is not true. That causes the validation to fail, and the item to revert to un-configured.

Was it you who configured the item in the first place?

 

[Jeremy]

In this case, I just placed that string in the table because I was trying to figure out how it decides when it can't be configured anymore. In previous tests, when I used the actual exploit trick, I thought the configuration column still had a string in it, but now I'm not sure.

For some reason, it now seems much easier to reproduce on my actual forum than my test forum. I'm not sure if that's because there are a lot more names for it to look through when checking availability. Maybe that's why it happens?

 

[Fillip H.]

How many users do you have on your forum? You can run

SELECT COUNT(*) FROM user

(remember your table prefix) to get the real figure, the vB statistics may be incorrect.

 

[Jeremy]

How many users do you have on your forum? You can run

SELECT COUNT(*) FROM user

(remember your table prefix) to get the real figure, the vB statistics may be incorrect.

109608

 

[Fillip H.]

Right, so you've got over 100k members. What's the specs of your server?

 

[DragonByte Technologies]

Hello Jeremy,

This ticket has now been closed with the status Cannot Reproduce.

We hope your issue or question has been addressed to your satisfaction. If not, please feel free to re-open it by clicking this link.

If you have any further issues or questions, please feel free to start a new support ticket via the button at the top of every page.

Thank you!