A security vulnerability (directory traversal) has been discovered in roster 1.7.3. This vulnerability can be used to include index.php files from anywhere on the server.

To fix, find this code in addon.php:

Code: Select all

// Get the addon's location
$addonDir = ROSTER_ADDONS.$_REQUEST['roster_addon_name'].DIR_SEP; 

And insert this code above it:

Code: Select all

// Sanity check on the addon name. We check both / and \ explicitly: \ may work on unix as well as the default /.
if( strpos($_REQUEST['roster_addon_name'], '/' ) || strpos($_REQUEST['roster_addon_name'], '\\' ) )
{
        die_quietly( "Hacking attempt averted" );
} 

Or Download here http://www.wowroster.net/Downloads/details/id=127.html

This vulnerability may touch earlier roster versions as well.
WoWRoster 2.0 is not affected by this vulnerability.