4 ms·

This is a pretty critical exploit . . . you'd think they'd take the app down or at least change the admin URL while this is resolved. I shouldn't at this momen

by pius 18y ago

This is a pretty critical exploit . . . you'd think they'd take the app down or at least change the admin URL while this is resolved. I shouldn't at this moment still be able to reset an arbitrary user's password by going to that URL.

oldgregg 18y ago
...and how many people have found it and not said anything? we've all used poorly secured admins here and there, but /admin seems particularly egregious.
- pius 18y ago
  ...and how many people have found it and not said anything? Scary.
  - simen 18y ago
    It was only open for an hour.
    - pius 18y ago
      No, it was only open and public for an hour. It could have been open for months, maybe longer.
      - simen 18y ago
        It was the result of a change today, right before it hit Hacker News (so sayeth Marco of tumblr in the #tumblrs irc channel, anyway; I believe him).
        pius 18y ago
        Ah.
        jlam 18y ago
        As we know, hackers regularly turn random door knobs to see which doors open. Logs i can see show more black hat attempts than white hat, so either OldGregg's friend got lucky or a few exploits might have already been made.