| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <492C220F.1000904@gmx.net>
Date: Tue, 25 Nov 2008 17:04:31 +0100
From: "nbbn@....net" <nbbn@....net>
To: bugtraq@...urityfocus.com
Subject: MyBB 1.4.3 my_post_key Disclosure Vulnerability
##################################################################################
#MyBB 1.4.3 my_post_key Disclosure Vulnerability by NBBN
(http://nbbnsblog.co.cc)
#
##################################################################################
Vendor: http://mybboard.net
Date: November 25, 2008
These URLs contains "my_post_key". Moderators and admins use these
sometimes, depending on what they want to do with a thread.
my_post_key is used to perform various actions and to prevent CSRF.
These pages shows the posts of the users. If some of these posts have
pictures, the referrer will be transfered to the server of the images.
#####Vuln
URLs#################################################################################
http://localhost/mybb/moderation.php?action=mergeposts&tid=1&modtype=thread&my_post_key=[key]
#
http://localhost/mybb/moderation.php?action=split&tid=1&modtype=thread&my_post_key=[key]
#
http://localhost/mybb/moderation.php?action=deleteposts&tid=1&modtype=thread&my_post_key=[key]
#
############################################################################################
Finally, an attacker has the postkey, and can perform some interesting
moderator or administrator actions with csrf.
Powered by blists - more mailing lists