I discovered today a vulnerability in og_menu, but may be it is also present in menus in general. This is from a production site with inexperienced users having access to og_menu items. The following link was entered in a menu item of a group of the model:
node/<group-node-id>/og_menu/<og_menu-name>/item/<id-of-this-menu-item>/edit
This can only be done when you edit an existing menu item, because before the is no known. So it is basically putting the edit link of the menu item in the link of the menu item. You can feel the recursion here and that is what is happening.
Apparently saving this menu item is causing that all editing of nodes is ending in the same recursion. Great thing for hackers and rather difficult to detect. I wanted to know the cause of this misterious problem and used this query to list probably related menu items:
SELECT * FROM `menu_links` WHERE `module` = 'menu' AND `link_path` LIKE '%/edit' AND `link_path`LIKE '%node%'
May be there should be a check in the menu system, denying links that cause recursion? May be it is already present in later versions, but still better a duplicate bug report then sorry
Comments
Comment #0.0
ñull commentedsurrounding with code tags
Comment #1
osopolarI can't see any vulnerability here. If someone wants to add a menu-link to a menu to edit a menu-link, why not, he should be able to do so. The menu-link won't show up if the user do not have rights to edit the menu-item.
Comment #2
rv0 commented