bugtraq - SOE's implementation of Lithium Forums Software allows users to log on as each other.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060519000457.825.qmail@securityfocus.com>
Date: 19 May 2006 00:04:57 -0000
From: john@...nhasson.com
To: bugtraq@...urityfocus.com
Subject: SOE's implementation of Lithium Forums Software allows users to
 log on as each other.

Original bug/exploit was sent to Sony Online Entertainment December 5th (5 months ago)
They havent fixed it yet.
You can read details here: http://johnhasson.com/blog/archive/2006/05/18/175.aspx

Summary:
When logging into the forums (tested with the Matrix Online game forums) your sessionid is passed along the URL.  And images/etc that link to other websites pass this URL along as the referrer.  This URL can be used to log in as that person with out any authentication.

Lithium has been contacted directly by me about this.  I am waiting to hear back from then.  SOE was also contacted it has not been fixed (5 months now) but they did say they would "pass it along"

Forum Link:
https://secure.station.sony.com/login/login/station/login_no_popup.jsp?returnURL=http%3A%2F%2Fmxoboards.station.sony.com%2Fmatrix%2F