bugtraq - Re: GamePlay.co.uk XSS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20060614011040.GE8279@hermes.americas.hpqcorp.net>
Date: Tue, 13 Jun 2006 18:10:40 -0700
From: Patrick Morris <patrick.morris@...com>
To: charlie@...hackersplace.org
Cc: bugtraq@...urityfocus.com
Subject: Re: GamePlay.co.uk XSS

On Sat, 10 Jun 2006, charlie@...hackersplace.org wrote:

> The current password is not necessary for a successful password change for members of gameplay.co.uk which makes changing passwords through scripts as easy as tying your shoe lace.
> (https://shop.gameplay.co.uk/gameplay/changepassword.asp)
> 
> I tried emailing these clowns about their silly flaws, but I had no joy.

If you are not logged in, that URL takes you to a login page, where you
*do* need to enter a correct username and password.

I'm not sure what happens if you've already logged in with a valid
account.