 Topic: |
Vulnerability in e-gold |
| Credit: |
shurik f gmail com |
| Date: |
2006.03.16 |
| CWE: |
N/A |
| CVE: |
CVE-2002-0370 (Show details)
Use CVE to see details like:
- CVSS2,
- Affected Software,
- References |
| Risk |
Local |
| Remote |
| Medium |
No |
| Yes |
Vulnerability was fixed in https://www.e-gold.com/acct/confirm.asp
money transfer script.
Problem description:
If authenticated user is referred to the script AccounID/PassPhrase validation is not performed.
By redirecting user to URL
https://www.e-gold.com/acct/confirm.asp?AccountID=123456&PassPhrase=some
string&PayeeAccount=MY_ACCOUNT&Amount=100&PAY_IN=1&WORTH_OF=Gold&Memo=Do
nation&IGNORE_RATE_CHANGE=y
it's possible to transfer money to another account without validation.
On march, 13th 2006 reported to e-gold
On march, 14th 2006 fixed
Details posted on http://bhunter.awardspace.com/vuln-en.html
I did get a small "buggs bounty" from e-gold for this info.
[ ASCII VERSION ]
|
