[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Full-disclosure] BBCode [IMG] [/IMG ] Tag Vulnerability
- To: full-disclosure@xxxxxxxxxxxxxxxxx
- Subject: Re: [Full-disclosure] BBCode [IMG] [/IMG ] Tag Vulnerability
- From: Jan Kantert <Jan_Kantert@xxxxxx>
- Date: Mon, 22 Aug 2005 12:58:18 +0200
There is a very similar trick: Often you also can take over PHP-session and get
authentificated as another user, if you just log referers of an image loaded
using [IMG][/IMG]. The user needs to have disabled cookies so that the
PHPSESSION is set in URL. This can be done automatically using a little
Perl/PHP-Script. You can use regex to parse out which useraccount you
compromised. If it was an administrator or moderator you could delete posts or
kick users.
Greetings,
Jan
_________________________________________________________________________
Mit der Gruppen-SMS von WEB.DE FreeMail können Sie eine SMS an alle
Freunde gleichzeitig schicken: http://freemail.web.de/features/?mc=021179
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/