Hello
What's about the vulnerability I reported 2 days ago for SMF 2.0.8 ?
you want an update? if it is to be fixed it will be included in the next patch for 2.0 branch. usually the dev team does not reach out to those that report issues unless they need more information.
I Don't need an update, i patched it myself. But all of you SMF users need to patch it also
I thought SMF team would answer to me because it's a critical flaw
and there is more to come..
Regards
The team is normally fairly prompt with dealing with vulnerabilities.
However, there are areas in SMF currently that have what are classified as XSS flaws that have been reported before and decided as 'will not fix' in the 2.0 branch because they are actively used by some users for unexpected side effects. The normal one is the board description for including raw HTML but there are other cases I'm aware of.
If it's admin-only, it's generally not considered so serious anyway because you still need to exploit an admin account and if you already did that, there are far more serious things you can do than merely exploit an XSS hole anyway. The theme editor, for example, is an XSS hole in itself, only it's worse because it allows for editing raw PHP and everyone seems to forget this is an XSS hole by design.
it is hardly a "critical flaw" and it is "amins only" which you already noted in your report.
It possibly will be patched in the next release, but there is little chance of this affecting anyone in real life, since - if the hacker has admin access, he can already do anything he wants.
I hope you're not making the same argument about the one I raised a short while ago? Even though that's admins only, the one I raised is potentially more serious than an XSS in an admin form.
No Arantor, as potentially unlikely as I find yours to be, they are real... Well, this one is real too... But anyway... 2.0.9 is being worked on... We just don't want to make the same mistakes that happened in 2.0.8 release,
Please don't say 'unlikely'. Unlikely things have a nasty habit of being abused in a malicious context. It should be noted that after the initial wave of 'pah, not a serious issue', one night while drunk I considered demonstrating it, but only a sense of ethics and a minor desire not to be permabanned from here stopped me.