Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web BBS :: Frequently Exploited :: va1922.htm

MyBB 1.4.3 my_post_key Disclosure Vulnerability



MyBB 1.4.3 my_post_key Disclosure Vulnerability
MyBB 1.4.3 my_post_key Disclosure Vulnerability



##################################################################################
#MyBB 1.4.3 my_post_key Disclosure Vulnerability by NBBN 
(http://nbbnsblog.co.cc) 
#
##################################################################################

Vendor: http://mybboard.net 
Date: November 25, 2008

These URLs contains "my_post_key". Moderators and admins use these 
sometimes, depending on what they want to do with a thread.
my_post_key is used to perform various actions and to prevent CSRF.

    
These pages shows the posts of the users. If some of these posts have 
pictures, the referrer will be transfered to the server of the images.
#####Vuln 
URLs#################################################################################
http://localhost/mybb/moderation.php?action=mergeposts&tid=1&modtype=thread&my_post_key=[key] 
#
http://localhost/mybb/moderation.php?action=split&tid=1&modtype=thread&my_post_key=[key] 
#
http://localhost/mybb/moderation.php?action=deleteposts&tid=1&modtype=thread&my_post_key=[key] 
#
############################################################################################ 


    
Finally, an attacker has the postkey, and can perform some interesting 
moderator or administrator actions with csrf.



TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH