GameConnect SourceBans Security Bypass Vulnerability
BID:43881
Info
GameConnect SourceBans Security Bypass Vulnerability
| Bugtraq ID: | 43881 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 22 2009 12:00AM |
| Updated: | Jun 22 2009 12:00AM |
| Credit: | Mr. Anonymous |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
GameConnect SourceBans Security Bypass Vulnerability
SourceBans is prone to a security-bypass vulnerability that allows an authenticated attacker to perform unauthorized actions using specially crafted URIs.
An attacker can exploit this issue to change administrator email addresses without proper authorization.
SourceBans 1.4.2 is vulnerable; prior versions may also be affected.
SourceBans is prone to a security-bypass vulnerability that allows an authenticated attacker to perform unauthorized actions using specially crafted URIs.
An attacker can exploit this issue to change administrator email addresses without proper authorization.
SourceBans 1.4.2 is vulnerable; prior versions may also be affected.
Exploit / POC
GameConnect SourceBans Security Bypass Vulnerability
Attackers can use a browser to exploit this issue.
The following data is available:
xxajax: ChangeEmail
xajaxargs[]: ADMIN_ID
xajaxargs[]: EMAIL_TO_CHANGE_TO
Attackers can use a browser to exploit this issue.
The following data is available:
xxajax: ChangeEmail
xajaxargs[]: ADMIN_ID
xajaxargs[]: EMAIL_TO_CHANGE_TO
Solution / Fix
GameConnect SourceBans Security Bypass Vulnerability
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
GameConnect SourceBans Security Bypass Vulnerability
References:
References:
- SourceBans - Homepage (GameConnect)
- SourceBans 1.4.3 released (GameConnect)