Bugtraq mailing list archives
Simple Machine Forum - Private section/posts/info disclosure
From: h3llcode () hotmail it
Date: 8 Nov 2007 13:40:19 -0000
# Vulnerable: Simple Machine Forum [ALL Versions] # # Tested on SMF 1.1.4 # # Type: Private Section,Posts,Information disclosure. # # Risk: Low / Medium # # Discovered By Seph1roth # # Site: http://www.blackroots.it -> The Best Hacking site. (eng / ita) # # Explanation: # # If some section is rescricted only for staff,vips or private groups/members,this bug can be used for read entire section and message, without privileges. # # Example: # # In my forum i've a Staff area , and into that , there is a message that contain Bug,exploit or some others keywords...i'll put in the advanced search module # this keywords ,and i select "show results as messages"...and tadaaa...my priv8 zone can be read by everyone... # # Greetz to all BlackRoots users! # # Shoutz to all kiddies!
Current thread:
- Simple Machine Forum - Private section/posts/info disclosure h3llcode (Nov 08)
- Re: Simple Machine Forum - Private section/posts/info disclosure Jindrich Kubec (Nov 09)
- <Possible follow-ups>
- Re: Simple Machine Forum - Private section/posts/info disclosure klynn . securityfocus (Nov 09)