BoastMachine v3.0 platinum - Session d Hacking

2007.05.30
Credit: Vagrant
Risk: Medium
Local: No
Remote: Yes
CWE: N/A


CVSS Base Score: 6.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8/10
Exploit range: Remote
Attack complexity: Low
Authentication: Single time
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

Vagrant - E-hack.org (05.22.2007) BoastMachine v3.0 platinum - Session d Hacking After the login into the site which alllows new user registration. Site user's data which is entered to change the topic, can be changed by another user, and that is a security hole because of ID interchangeability in URL address space. If the changed topic belongs to the admin it doedn't affect the free login and site user has an authority to make changes and cop the topics. ------- >>> Vulnerable; http://www.xxx.com/login.php http://www.xxx.com/user.php?action=list_posts Edit posts; http://www.e-hack.org/user.php?action=list_posts Post title edit; http://www.xxx.com/user.php?action=edit_post&blog=1&id=(155) = (d) New d; http://www.xxx.com/user.php?action=edit_post&blog=1&id=(154) = (d) Credits : Vagrant Contact : kernel-32 (at) hotmail (dot) com [email concealed] Site : www.e-hack.org _________________________________________________________________ Siz de iletiþimin evrimine katln! http://www.communicationevolved.com/tr-tr/


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top