[28134] in bugtraq
APBoard-Bug
daemon@ATHENA.MIT.EDU (DNA ESC)
Fri Dec 6 18:54:39 2002
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0
Date: Fri, 6 Dec 2002 13:03:21 -0800 (PST)
From: DNA ESC <dna@http.ch>
To: bugtraq@securityfocus.com
Reply-To: dna@http.ch
Message-Id: <20021206210322.6FBC8406B@sitemail.everyone.net>
Product: APBoard-Bug
Versions: tested on 2.02
Vulnerability: users can subscribe a thread in the internal forum
Date: Dezember 5, 2002
Discovered by: DNA <dna@es-crew.de>
Introduction:
Normal Users can read new answers to a thread in the internal forum
I have already informed APP about this vulnerability!
Exploit:
1.) register an account on vuln board
2.) while the number of the threads from the intern board were seen in the public board , everybody can see when a new thrad were created
3.) You are able to get the thread-id of the last created thread in the internal form by increasing the last public threadid by one.(you may find it by searching + sort by date)
4.) Using the link
www.board.de/useraction.php3?action=subscribe_thread&threadid=
it is possible to subscribe an internal thread whose replies will be sent to you by email automatically.
------------------
for example: (in case of threadid=990)
www.board.de/useraction.php3?action=subscribe_thread&threadid=990
"useraction.php" does no test whether the subscription is allowed or not, so an unauthorized
person is able to read the replies he was sent, which eleminates the intention of the
internal forums' existance.
-------------------
Sorry but i can't speak english very well
- DNA
- http://www.es-crew.de
_____________________________________________________________
Sign up for FREE email from http.ch - http://www.http.ch
yourname@http.ch for free ;o) !
_____________________________________________________________
Select your own custom email address for FREE! Get you@yourchoice.com w/No Ads, 6MB, POP & more! http://www.everyone.net/selectmail?campaign=tag
