Hacking ads bypass in ClassiPress 3.x.x - Hole Security
Well, the scenario is:
You have the ClassiPress 3.2.1 running and you setup to charge for ads (packs) and charge for featured ads.
Step1) Your registered user fill up the form and select the package he want and the featured option if he wants. Both will charge the registered user;
Step2) The registered user will see the summary of the ad with the value to charge; eg: 40 USD; and he will select the desired payment method.
Step3) He will be redirected to gateway processor or will receive the instructions for the payment.
Sounds good huh? No problem here at all...
But the user goes to his dashboard he will see his ad with the "waiting payment" status and the "delete ad" link
Here is the hole: the link to "delete ad" sounds like: ?aid=777&action=delete
If the user has some knowledge of ClassiPress, PHP or even some logic he can change the action via post
As I know ClassiPress have some actions like pause, delete, renew, restart, setsold, unsetsold
I can simply change ?aid=777&action=pause and hit enter and I'll get my ad paused and voilą!
It will bring me more actions like edit, delete, restart, setsold
Well as I want to make it visible, so let's restart my ad! change the url to ?aid=777&action=restart or just click on restart button
You add will be visible to anyone and you don't have to pay for it
very very simple!
I hope AppThemes Team could fix this asap!
If you want to fix it just open the
tpl-dashboard.php
Look for:
PHP Code:
$delete_url = add_query_arg( array( 'aid' => $post->ID, 'action' => 'delete' ), CP_DASHBOARD_URL );
echo '<a onclick="return confirmBeforeDelete();" href="' . $delete_url . '" style="display: block;">' . __('Delete Ad', 'appthemes') . '</a>';
and comment it adding // in front of both lines
PHP Code:
//$delete_url = add_query_arg( array( 'aid' => $post->ID, 'action' => 'delete' ), CP_DASHBOARD_URL );
//echo '<a onclick="return confirmBeforeDelete();" href="' . $delete_url . '" style="display: block;">' . __('Delete Ad', 'appthemes') . '</a>';
You will find it on lines 172-173 and 184-185
and on lines 195-196 you can delete those lines:
PHP Code:
<?php $delete_url = add_query_arg( array( 'aid' => $post->ID, 'action' => 'delete' ), CP_DASHBOARD_URL ); ?>
<a onclick="return confirmBeforeDelete();" href="<?php echo $delete_url; ?>" title="<?php _e('Delete Ad', 'appthemes'); ?>"><img src="<?php bloginfo('template_directory'); ?>/images/cross.png" title="<?php _e('Delete Ad', 'appthemes'); ?>" alt="<?php _e('Delete Ad', 'appthemes'); ?>" border="0" /></a>
This will prevent your users from "hacking" your ads
I think other products of AppThemes uses the same code as ClassiPress uses, so be careful and wait for an update/fix from AppThemes Team.
This security issue was found by PatrickJose