Tapatalk security issue

[rajpb]

There is big security issue with tapatalk. Anyone can read any PM.
I know that phpbb.com does not suport tapatalk but there are many phpbb forums with tapatalk plugin on.
You must have account in phpbb forum with tapatalk.
Next take link to PM on this forum and copy it to mail or chat in tapatalk.
Link like this ucp.php?i=pm&mode=view&p=2105316
On the phone/tablet, run the link in the tapatalk app.
When You change pm id in link (p=....), You can see any PM in this forum.

I made two security tickets on the tapatalka page, at first (I made it on the second of April) I did not even get an answer or ticket number. After second (two weeks later) they asked for additional information, but still they did not even give me a ticket number.

I was tested it in 2 different phpbb forums, in one there was phpbb 3.2.2 and tapatalk plugin 2.0.8 - both newest ones.

[Mick]

The best piece of advice is don’t use tapatalk, there are too many security bugs with it as can clearly be seen by the dozens of complaints about it on here. In any case, I don’t see the need for it.

[Swanny]

I was able to duplicate this issue. Indeed I could craft a link and read multiple PM's. Completely unacceptable. Disabling TT immediately and will contact TT.

[LaxSlash1993]

Has a CVE entry been filed against it yet?

[</Solidjeuh>]

Over a few years there where many many many messages here on phpBB.com about tapatalk, all about that it's a piece of sh**. So I really wonder why people are still using it ???

[Swanny]

Has a CVE entry been filed against it yet?

I don't know what that means.

Over a few years there where many many many messages here on phpBB.com about tapatalk, all about that it's a piece of sh**. So I really wonder why people are still using it ???

Because users rage at me when I turn it off. And traffic drops. It is a piece of shit, I agree. But users love it.

[3Di]

I don't know what that means.

https://cve.mitre.org/cve/identifiers/index.html


https://cve.mitre.org/cgi-bin/cvekey.cg ... d=tapatalk

[rajpb]

Has a CVE entry been filed against it yet?

no

[Ger]

Because users rage at me when I turn it off.

You might want to explain to them that if you turn it back on, their PM's will be visible for the world. And also explain that phpBB has been responsive for quite some years now and how they can create a shortcut from their homescreen.

[kamyk25]

Taptalk have many gaps for example it not work with cloudflare. I really dont like this app I prefer to give users nice responsive style to use on phones, but they like to use taptalk so I have to keep this app.

[Ger]

Taptalk have many gaps for example it not work with cloudflare. I really dont like this app I prefer to give users nice responsive style to use on phones, but they like to use taptalk so I have to keep this app.

Do they also like to have their private messages public?

[Swanny]

Taptalk have many gaps for example it not work with cloudflare. I really dont like this app I prefer to give users nice responsive style to use on phones, but they like to use taptalk so I have to keep this app.

It works fine with Cloudflare, I've been doing that for quite a while. At most you'd have to setup a page rule to exclude the /mobiquo/ and /ext/tapatalk/ folders in CF.

[Swanny]

UPDATE: Tapatalk got back to me within a day. Good news:

MAY 08, 2018 | 07:12AM UTC
Summer replied:
Hello,
Thank you for contacting Tapatalk!
This is a known issue and we’ve fixed it.
And we plan to release the new version on this week.
Please watch the change-log for your forum platform and update accordingly:
https://www.tapatalk.com/groups/tapatal ... -s110.html

Apologize for the inconvenience. Let us know if you have any questions.

Regards,
Tapatalk Support Team

Tapatalk is still a huge piece of shit so I won't turn it back on right away. I'll wait and see if anyone rages for a few weeks and again evaluate traffic levels.

[Mick]

You might want to explain to them that if you turn it back on, their PM's will be visible for the world. And also explain that phpBB has been responsive for quite some years now and how they can create a shortcut from their homescreen

Basically this, you set the rules not the users.

Does tapatalk still have the issue of making all new users moderators?

[Wes of StarArmy]

I have two+ Tapatalk forums because Tapatalk bought Network54 and Yuku (was ezBoard) and I'm currently looking into ways to get my databases out of their clutches. Hearing about security issues like this just makes it more urgent. Might just end up using some sort of scraper to get my content then disable the Tapatalk boards.

I never asked to be one of their users.