5 ms·
A confirmed security vulnerability in 30 web sites
- narad 14y agoI am getting "Sorry, this page is temporarily unavailable while we perform necessary server maintenance." Good move.
- pain_perdu 14y agoI'm not sure if you're saying you are getting that error from the link I shared or one of the sublinks or even trying the proof of concept but in any event here is a mirror of the main link just in case: http://pastebin.com/Yyrt2qtp http://pastebin.com/Yyrt2qtp
- dangrossman 14y agoIt's the URLs in the script on the susceptible sites that are showing that error if you access them yourself. E.g. http://assetform.itbusinessedge.com/acl/accountController.jsp http://assetform.itbusinessedge.com/acl/accountController.js...
- codelion 14y agohttp://white-hackers.blogspot.sg/2013/03/how-to-hack-30-highly-popular-websites.html http://white-hackers.blogspot.sg/2013/03/how-to-hack-30-high... Other link found by searching on google
- camus 14y agoSo as i understand it , if you put the user id in a cookie it allows anyone to "spoof" the server and login as any user but sending just a fake cookie ?
- anotherbadlogin 14y agoHere's another bonehead move by a lot more sites: http://goldmanosi.blogspot.com/2012/06/forcing-people-to-use-e-mail-address-as.html http://goldmanosi.blogspot.com/2012/06/forcing-people-to-use...
- deleted 14y ago[deleted]
- johnsoft 14y ago>Vendor stores database IDs in cookies which are easily spoofed (USERID_COOKIE), allowing all user information to be accessed. If this means what I think it means, why did it take until 2013 for this to be discovered?
- wuest 14y agoThis bug is not yet completely squashed in the wild: ' OR 1=1 --
- merlincorey 14y agoYou mean reported publicly.