I recently downloaded (from Xoops Sourceforge)

XOOPS2_mod_yogurt_3.30_RC2_marcellobr.zip

Unfortunately, I have subsequently found several posts here and also on the ICMS forum relating to a security issue.

Someone at ICMS appears to have taken over development of the module, but was surprised to see that although they are aware of the security risk (AFAIK) they have not made a secure version available for public download. The version ICMS offer for download seems to be the same RC.

If the version I have downloaded is insecure, can someone post the solution so I can fix it myself?

The original developer clearly worked hard on this module and it would be a shame not to be able to use it.

I spent 10 minutes looking at it and found 3 $_POST variables not sanitized, I'm not a hacker but I suppose we can use CURL to Post whatever we want, including tokens.
I found 1 $_GET variable not sanitized, this one can be easily exploited.

I have looked at half of the root files only.

If you want to fix yogurt, take a look at all $_GET and $_POST and use intval for every value that is expected to be an int. If it is a string, make sure you use $myts->addslashes before passing it into a criteria or better, $db->quotestring

Many thx Trabis. I'll work through the code in each file now I know what to look for.

Peekay if you don't mind can you share the module after you have fixed it..

thank you