the org just found that some authors are putting auto-install clickers in their products. I happen to know which mods these are in, but I'm wondering what your opinion on the topic is.

Clicking install may be harmless, but if that code runs.. so could something that sends your database details out over the net to xxx server :ninja:

You mean in the install script? That trick has been around for ages, I remember using it aswell (not anymore though :p).

Sending data out isn't that simple though, the install script is simply redirecting the browser to the install link. Sending the database details would be a whole different thing ;).

yeah, but the code isn't so different. just add a $variable to the get request and change the domain name and it becomes rather dangerous.

glad I read the source on stuff (:o)

Well, it's still not that easy. I'm pretty sure the DB password is either encrypted or unset when starting a script.

hehe, maybe I'll need to try a proof of concept on my test board and see what happens

probably do that later today

Alright, let me know.

Also, what good is the DB info? You're running their file, if it send the DB info it might aswell make the changes when its ran.

I dont see it as a problem but do wonder about the security side of things.

I know which mods they are in as well - since I wrote the code they are referring to.

BTW - they aren't actually calling 'home' either, as vb.org is not my home forum.

The whole thing is just unbelievable - I can only guess at the reasons for the massive fuss - calling the link as that code did is utterly harmless - a massive overhype over nothing. They seem bent on self destruction atm - and are doing a fine job about it.

well, after about 15 minutes of playing around with code I managed to do the following on my test site with an exploit in the .xml

steal database, get config.php contents, delete database, etc.

doesn't seem to be any limit, the product import is not run in any sort of secure environment

Is all that mountains from molehills crap going to infect this place as well? vBORG staff is again, OTT.