[31009] in bugtraq
phpbuilder.com unrestricted page!
daemon@ATHENA.MIT.EDU (npguy)
Fri Aug 1 17:55:37 2003
Message-ID: <002301c3580d$fd286d10$0265a8c0@mailserver>
From: "npguy" <npguy@ysgnet.com>
To: <ysgnet@topica.com>
Date: Fri, 1 Aug 2003 15:04:19 +0545
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-MDaemon-Deliver-To: bugtraq@securityfocus.com
recently, 01 security submission has discovered a serious problem with
phpbuilder.com
---[ about phpbuilder.com ]---
phpbuilder.com is one of the premier php site. Thousand of developer share
and contribute their
articles on php.
---[summary]---
the bug actually allows any user to launch DOS attack!
phpbuilder.com has not restricton in "page", making it possible to tie up
all the connection slots and consume a lot of CPU on the server.
--[exploit]--
change the page value!.
http://www.phpbuilder.com/columns/mattias20000105.php3?page=1
viz,
http://www.phpbuilder.com/columns/mattias20000105.php3?page=1333
what about this?
http://www.phpbuilder.com/columns/mattias20000105.php3?page=13333
and wait for result. there is not restricton in "page" variable, so u can
assign upto 2^32...r u mad?
---[about 01 security submission]---
01s.s is a small group having experience as security specialists,
programmers and system administrators
http://www.ysgnet.com/hn.
