SecWatch.org: CJ Tag Board Multiple Parameter Handling PHP Code Injection Vulnerabilities
5785
According to this posting on the SecWatch board today, there are some issues with the CJ Tag Board software that allow for code injection issues.   Multiple input validation vulnerabilities in CJ Tag Board have been reported, which can be exploited by remote users to compromise a vulnerable system.   The issue comes from improperly filtered user input for the "User-Agent" HTTP header and the "banned" parameter for the admin side. This issue effects CJ Tag Board version 3.0. No update or patch has been posted as of yet to correct this issue.
154380
Paul Reinheimer, one of two behind the funcaday website (providing details on one PHP function each day and special content on the weekends) has posted a supplement to this weekend's posting covering escaping.   The disadvantage with the escape for now, not for later approach is simple. If you save a user's post to the database, then that user's post is displayed 2,000 times there will be some serious differences. [...] You will need to balance your security concerns with performance needs.   The comments on his post back up his suggestions (and include other tips like a recommendation to cache on an even higher level - page blocks).
400610
php|architect has a new link to an article from OnJava.com concerning the use of JMS with PHP.
104107
Embedded Problems &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
83975
Three different ActiveX vulnerabilities affect Yahoo Instant Messenger version 3.5,  and Yahoo Messenger versions 4.0, 5.0, and 5.5
642167
Newly posted over on PHP Magazine's website is this week's latest PHPBarnstormer - Issue #11
467808
Devshed has posted a new article covering one of the hottest topics in the PHP community right now - security.   Security in a scripting language such as PHP is more developer-dependent than language-dependent. In other words, although the language offers you the tools to create secure code, it cannot prevent insecure code. Thus, the degree to which code is secure almost entirely depends on how security conscious a developer is.   The article looks at three security-related topics:  Register globals error reporting code exposure  and for each provides explanation and code where needed to help the reader understand the issues and possible problems with them.
126013
On Dynamically Typed today, there's a new posting concerning the PHP Atom Server.
460038
In this post to his blog, Chris Shiflett talks about some issues surrounding character encoding and the cross-site scripting issues it can open up in your application.    In the post [on Good and Bad PHP Code], he provides a few useful PHP interview questions, including some questions from Yahoo. He explains that good PHP code should be Structured, Consistent, Portable and Secure   In the comments, many additional improvements have been suggested, but there's one that has yet to be mentioned. When using htmlspecialchars() without specifying the character encoding, XSS attacks that use UTF-7 are possible.    Included in the post is an example to illustrate the point as well as a solution, a simple one involving the header() function, to help correct the problem and prevent bad things from happening.   Be sure to check out http://shiflett.org/blog/2007/may/character-encoding-and-xss#comments">the comments for more great tips.
466917
This third and final article in the Metasploit series covers the msfcli scripting interface as well as the intuitive web interface to the Framework. The article also discusses what's new with version 2.2, and then introduces the exploit development process through an example.
579233
Ed Finkler has pointed out a handy resource for those trying to cope with using the UTF-8 support included in several of PHP's functions - this page on the Web Application Component Toolkit wiki.   This page is intended as a reference for functionality PHP provides which can either help with handling UTF-8 or should be regarded as a risk when used in conjunction with UTF-8 encoded strings. Further information can be found on the Internationalization (I18N) and Character Sets / Character Encoding Issues pages.   It talks about the "dangerous" functionality PHP has (issues that the language has in current functions) when using things like the PCRE extension, the string extension, the array methods, handling variables, the XML extensions (DOM and SAX), image manipulation, and URL parsing functionality.
415712
To set things right about a misquote on Slashdot, Zeev Suraksi has posted this long statement mentioning what he really said and a few more personal opinions.   I've just been misquoted on Slashdot, as if I said there are no security problems in PHP itself, and that I instead point my finger only at inexperienced developers. If you read the original article on Heise Security, you'll see that I have not said anything of the sort. [...] I believe this is the belief of most others on the security team, but I'm only speaking on behalf of myself and do not represent them.   He also covers five more points pertaining to the article and the situation:  Where the bugs/problems lie with problems in PHP Why there are security problems in web PHP applications Why the current security level can be partially blamed on the language itself An admission that yes, there are security problems in PHP And the track record the PHP developers have had in fixing these issues  There's much more than just these brief highlights here, so I encourage you to head on over and check out the full post for yourself.   There are some other opinions on the matter from a few others out there too:  cyberlot's blog Zend Developer Zone's post Tony Bibbs' blog
261826
PHP Magazine has posted their latest issue of the PHPBarnstormer (Issue #19):
558542
Easy-peasy-sleazy: A new piece of PHP code making the malware rounds can install a phishing site on a compromised server in about two minutes.
386588
Latest PHPClasses.org Releases:Smarty and MIME message integrationYour SayphpPhotoGalleryInterfacesIlariaParser 7just7.comaDB PDO like database abstractionSAMP Socket
104778
Latest PHPClasses.org Releases:Multi-Dimensional Array HandlerMySQL2JSONBBCode ParsersphpcompilerProcessingExponsor ModSimplePagingweb20vnRouterSStatusMagic ArraysqlExecmyAltCaptchaDynamic Methodpreg_magic
670574
The latest edition of PHP Magazine's PHPBarnstormer has been posted (Issue #17).