3 ms·

No offense intended, but I really don't know how it's possible to write a forum with so many vulnerabilities. Forums aren't exactly rocket science. It's basic i

No offense intended, but I really don't know how it's possible to write a forum with so many vulnerabilities. Forums aren't exactly rocket science. It's basic input validation and you're good to go. Many recent functions (in PHP) already sanitize input even if you forget. So things like parametrized SQL queries and browser same origin policies really help limit the attack surface. I find it depressing that vBulletin has been getting hacked for so long that it's literally outlived several of the major vulnerability disclosure websites that have historically published exploits about it (like milw0rm -- still an amazing theme, btw.) Maybe PHP should throw warnings about eval and recommend an alternative function purely for expressions instead. In Python apparently eval evaluates expressions for a result and exec would do what PHP's eval would do instead. Something like that for PHP would be better than nothing.

userbinator 7y ago
No offense intended, but I really don't know how it's possible to write a forum with so many vulnerabilities. Forums aren't exactly rocket science. It's basic input validation and you're good to go. You are definitely very correct about that, for a simple forum with basically no extensibility. Bugs arise from the fact that vB is extremely customisable and has lots of points for extension, making its codebase very complex.
zone411 7y ago
I don't know where you got this idea - full featured forums are very complicated compared to what most sites do.
reaperducer 7y ago
Every piece of software is simple and easy when someone else has to write it. Unnamed Goose Game? It's just a bunch of polygons and MIDI riffs. No big whoop. Slack? It's just a chat agent. Just some input validation and syndication. Easy peasy. Microsoft Windows? It's just a window manager running on DOS. No sweat, I could whip that up over the weekend.
dsego 7y ago
If the codebase is anything like drupal or joomla, it doesn't surprise me. Those old school php systems are textbook examples of spaghetti code and big ball of mud patterns.

userbinator 7y ago

No offense intended, but I really don't know how it's possible to write a forum with so many vulnerabilities. Forums aren't exactly rocket science. It's basic input validation and you're good to go. You are definitely very correct about that, for a simple forum with basically no extensibility. Bugs arise from the fact that vB is extremely customisable and has lots of points for extension, making its codebase very complex.

zone411 7y ago

I don't know where you got this idea - full featured forums are very complicated compared to what most sites do.

reaperducer 7y ago

Every piece of software is simple and easy when someone else has to write it. Unnamed Goose Game? It's just a bunch of polygons and MIDI riffs. No big whoop. Slack? It's just a chat agent. Just some input validation and syndication. Easy peasy. Microsoft Windows? It's just a window manager running on DOS. No sweat, I could whip that up over the weekend.

dsego 7y ago

If the codebase is anything like drupal or joomla, it doesn't surprise me. Those old school php systems are textbook examples of spaghetti code and big ball of mud patterns.