Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: Apps :: b06-3157.htm

Dragons Kingdom v1.0 - XSS & cookie disclosure



Dragons Kingdom v1.0 - XSS & cookie disclosure
Dragons Kingdom v1.0 - XSS & cookie disclosure



Dragons Kingdom Script v1.0=0D
=0D
Homepage:=0D
http://www.dkscript.com/=0D 
=0D
Affected files:=0D
=0D
*Sending mail:=0D
- Sending in-game mail=0D
=0D
=0D
*Character Profiles:=0D
- All input boxes of the profile=0D
=0D
=0D
* Posting & Replying in the forum:=0D
- Posting in the forum=0D
- Replying in the forum=0D
=0D
* Form spoofing can occur in:=0D
- Profile input boxes=0D
- Posting in the msgboard=0D
- Sening in-game mail.=0D
=0D
* Gambling Den:=0D
- High or low game.=0D
=0D
* Exploring=0D
- Using the compass=0D
---------------------------------------------=0D
=0D
XSS vuln with cookie disclosure when sending in-game mail:=0D
=0D
User data isn't sanatized before being generated. =0D
=0D
For a PoC send someone a mail that says:=0D
=0D
=0D
=0D
Screenshots:=0D
http://www.youfucktard.com/xsp/dragking1.jpg=0D 
http://www.youfucktard.com/xsp/dragking2.jpg=0D 
=0D
Displaying our cookie:=0D
http://www.youfucktard.com/xsp/dragking3.jpg=0D 
--------------------------------------------=0D
XSS vulns with cookie disclosure in character profiles:=0D
=0D
The form for editing your player profile can be spoofed to increase the maxchar limit to create our xss example.=0D
=0D
Vulnerable profile input boxes:=0D
=0D
- Gender=0D
- Country/Location=0D
- MSN Messenger=0D
- AOL IM=0D
- Yahoo IM=0D
- ICQ=0D
=0D
Screenshots:=0D
http://www.youfucktard.com/xsp/dragking4.jpg=0D 
http://www.youfucktard.com/xsp/dragking5.jpg=0D 
------------------------------------------=0D
XSS vuln when posting in the forum or replying:=0D
=0D
User data isn't sanatized before being generated. =0D
=0D
For a PoC put the code below as your forum topic or msg:=0D
=0D
=0D
Also works when replying to msgs.=0D
=0D
=0D
PoC screenshots:=0D
http://www.youfucktard.com/xsp/dragking6.jpg=0D 
http://www.youfucktard.com/xsp/dragking7.jpg=0D 
=0D
--------------------------------------------=0D
=0D
Gambling Den bet bypass:=0D
=0D
It seems if you don't like your first card you got, you can refresh the screen and another random card will appear on screen. This makes it very easy to guess & cheat at this game.=0D
=0D
------------------------------------------=0D
=0D
Exploring bypass:=0D
=0D
If you just want to power level and don't want to wait for the compass to load you can use the link below. You'll stay on the same tile, but fatique will increase like you're moving, and mobs will attack you.=0D
=0D
http://www.example.com/index.php?do=move&setdir=North&getkey=1&pK=North=0D 
----------------------------------------=0D


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH