|
|
|
|||||||
| Notices |
Register Now for FREE!
|
 |
|
|
LinkBack | Thread Tools | Display Modes |
08-04-2008
|
#1 (permalink) |
|
Studentz
 
Join Date: Jun 2006
Location: On port u forgot to secure!
Age: 18
Posts: 6,042
Thanks: 54
Thanked 147 Times in 115 Posts
Rep Power: 241
   |
[0day] phpBB 2.0.23 Session Hijacking Vulnerability
::Information about this vulnerabilty
If a moderator or an admin close a thread in phpBB 2.0.X, the sessionid is sending with GET: Code:
http://site.tld/phpBB2/modcp.php?t=1&mode=lock&sid=[session] The admin/moderator are going to be redirected to the thread(with the session). If an attacker has posted an image in his post, he can see the referer and so the session id. And if the attacker have a good day and the admin close the thread, he can use all admin-functions with csrf.
__________________
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts. |
|
    
|
|
| Bookmarks |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| Display Modes | |
|
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| IceBB <= 1.0-RC9.2 Blind SQL Injection / Session Hijacking Exploit | saswata | Exploit Codes | 0 | 07-27-2008 04:01 AM |
| Six killed in Thai south in clashes and hijacking | The Boss | World News | 0 | 06-01-2008 03:41 PM |
| Sarah Young / Photo Session | waginas89 | Videos (Desi and Videsi) | 0 | 05-07-2008 02:42 PM |
| phpBB 2.0.19 DOS Vulnerability | KnightRider | Exploit Codes | 0 | 04-09-2008 01:48 PM |
Linear Mode
