Search: Home Bugtraq Vulnerabilities Mailing Lists Jobs Tools Beta Programs
BugTraq
Name:
Email:
*Note: Email address will appear as "user domain ext" to prevent harvesting.
Subject:
Message:
 
flashchat severe bug Oct 17 2008 02:44PM
ch0p83 gmail com
File: connection.php

if(

ChatServer::userInRole($this->userid, ROLE_ADMIN) ||

ChatServer::userInRole($this->userid, ROLE_MODERATOR) ||

($req['s'] == 7) <-- *bypass line*

)

This piece of code allows a normal user to bypass role filtering and to be granted admin ...

[ more ]  




 

Privacy Statement
Copyright 2009, SecurityFocus