Simple Machine Forum - Private section/posts/info disclosure Nov 08 2007 01:40PM
h3llcode hotmail it (1 replies)
# Vulnerable: Simple Machine Forum [ALL Versions]

#

# Tested on SMF 1.1.4

#

# Type: Private Section,Posts,Information disclosure.

#

# Risk: Low / Medium

#

# Discovered By Seph1roth

#

# Site: http://www.blackroots.it -> The Best Hacking site. (eng / ita)

#

# Explanation:

#

# If some section is rescricted only for staff,vips or private groups/members,this bug can be used for read entire section and message, without privileges.

#

# Example:

#

# In my forum i've a Staff area , and into that , there is a message that contain Bug,exploit or some others keywords...i'll put in the advanced search module # this keywords ,and i select "show results as messages"...and tadaaa...my priv8 zone can be read by everyone...

#

# Greetz to all BlackRoots users!

#

# Shoutz to all kiddies!

[ reply ]
Re: Simple Machine Forum - Private section/posts/info disclosure Nov 08 2007 10:36PM
Jindrich Kubec (kubecj asw cz)


 

Privacy Statement
Copyright 2010, SecurityFocus