[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Vbulletin 3.6.5 Sql Injection ! [misc.php]
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: Re: Vbulletin 3.6.5 Sql Injection ! [misc.php]
- From: scott-REMOVE@xxxxxxxxxxxxx
- Date: 14 Apr 2007 14:25:02 -0000
There is no SQL injection being performed on that page, the proof of concept
script simple grabs any 32 character string from the page, the one in question
happens to be a logout hash.
The logout hash is used to mitigate a CSRF.