RE: [cobalt-users] userList.php possible exploit

["H.P. Noordam" <bno@xxxxxxxxx>]

> Two additions:
> 1) It doesn't have to be a site admin, any user will do
> 2) This bug affects every page/listing in the 550 GUI!

> It was reported on the Sun Support forums, back in Dec 2002.
> Solution is to patch the PHP code with authentication checks.

> --anders

> PS. Note that it is "only" viewing, modifying gives errors.



hmm i guess the inability to actualy SAVE the screens you can get, takes the
real bite out. Still, it is quite stupid that any user can see just about
everything from other hosted sites.

a quick searh on the forums & KB didnt get me a thread about prior solutions
so i guess the issue is too old, do you know if there was an "official" way
to patch the code, or is it left to the users ?

Bob.