[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Versions: tested on 2.02
Vulnerability: users can subscribe a thread in the internal forum
Date: Dezember 5, 2002
Discovered by: DNA <dna@xxxxxxxxxx>
Normal Users can read new answers to a thread in the internal forum
I have already informed APP about this vulnerability!
1.) register an account on vuln board
2.) while the number of the threads from the intern board were seen in the public board , everybody can see when a new thrad were created
3.) You are able to get the thread-id of the last created thread in the internal form by increasing the last public threadid by one.(you may find it by searching + sort by date)
4.) Using the link
it is possible to subscribe an internal thread whose replies will be sent to you by email automatically.
for example: (in case of threadid=990)
"useraction.php" does no test whether the subscription is allowed or not, so an unauthorized
person is able to read the replies he was sent, which eleminates the intention of the
internal forums' existance.
Sorry but i can't speak english very well
Sign up for FREE email from http.ch - http://www.http.ch
yourname@xxxxxxx for free ;o) !
Select your own custom email address for FREE! Get you@xxxxxxxxxxxxxx w/No Ads, 6MB, POP & more! http://www.everyone.net/selectmail?campaign=tag