bugtraq - Simple Machine Forum - Private section/posts/info disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: 8 Nov 2007 13:40:19 -0000
From: h3llcode@...mail.it
To: bugtraq@...urityfocus.com
Subject: Simple Machine Forum - Private section/posts/info disclosure

# Vulnerable: Simple Machine Forum [ALL Versions] 
#
# Tested on SMF 1.1.4
#
# Type: Private Section,Posts,Information disclosure.
#
# Risk: Low / Medium
#
# Discovered By Seph1roth
#
# Site: http://www.blackroots.it -> The Best Hacking site. (eng / ita)
#
# Explanation:
#
# If some section is rescricted only for staff,vips or private groups/members,this bug can be used for read entire section and message, without privileges.
#
# Example:
#
# In my forum i've a Staff area , and into that , there is a message that contain Bug,exploit or some others keywords...i'll put in the advanced search module # this keywords ,and i select "show results as messages"...and tadaaa...my priv8 zone can be read by everyone...
#
# Greetz to all BlackRoots users!
#
# Shoutz to all kiddies!