Noah's Classified via Fantastico

[testube]

I had just installed this script on one of my servers via Fantastico, and was playing around with it a bit, but had to visit their forum to see how to tweak part of it. While on the forum, I noticed a few scary things about it...primarily a link to this page:
http://www.frsirt.com/english/advisories/2006/0703

Solution:
---------
There is no vendor supplied patch for this issue.
From Vendor`s website:
"Currently, we are completely overloaded with our
running projects, and we don't have enough time to deal with our free
products. The further development and support of Noah's
Classifieds is therefore suspended.
Thank you for the understanding and please forgive us
that we don't responding to the emails."

None-the-less, I looked into their scripting a bit and it is A MESS. A hack to fix this would take me more time than it would be worth. (Most of the commenting is in Hungarian??)

I just wanted to warn others of these vulnerabilities and the fact that the author isn't planning on supporting it in any way. You may want to steer clear of this one. I would even suggest that WebHSP remove it from the Fantastico options, if possible. This is a disaster just waiting to happen.

Does anyone know of a stable and secure alternative? I'm thinking that a CMS may do the trick, with a bit of tweaking, but it would be nice to find something that was a quick setup, as Noah's had appeared to be.

Thanks in advance!
- Jeff
////////////////////////////////////
http://www.spellingsearch.com

[WHSP-Mark M]

Hi Jeff,

Thank you very much for the heads up on this matter.  There are certainly a large variety of concerns with this program. I have checked on the netenberg.com forums (the company that makes fantasico) and it seems there a large number of bugs with this program and they are currently considering marking it as deprecated.

In the meantime, we see that there is a rule out for our mod_security installation to protect our servers and clients from this type of SQL Injection attack and we will be implimenting this rule over the next couple of days.

Best Regards,
Mark,
WebHSP Support

[testube]

Thanx, Mark.

Just wanted others to know before anything happened to someone...I saw more than just SQL injections listed as possible threats...too many unchecked variables, password hacks, etc.

Thanks again for your prompt response,

Jeff

[WHSP-Mark M]

Hi Jeff,

It is never a problem. If you should have any more questions or concerns, then do let us know.

As well if we hear of any more developments with regards to this script we will certainly let you know.

regards,
Mark