Tritanium Scripts Tritanium Bulletin Board Unauthorized Access Vulnerability
BID:8944
Info
Tritanium Scripts Tritanium Bulletin Board Unauthorized Access Vulnerability
| Bugtraq ID: | 8944 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 31 2003 12:00AM |
| Updated: | Oct 31 2003 12:00AM |
| Credit: | The disclosure of this issue has been credited to Virginity Security <[email protected]>. |
| Vulnerable: |
Tritanium Scripts Tritanium Bulletin Board 1.2.3 |
| Not Vulnerable: | |
Discussion
Tritanium Scripts Tritanium Bulletin Board Unauthorized Access Vulnerability
It has been reported that Tritanium Bulletin Board may be prone to an access validation error that may allow a remote attacker to to gain unauthorized access to threads. A remote attacker may be able to access sensitive data by modifying the URL and supplying a value for thread_id, forum_id, and sid paremeters.
Successful exploitation of this issue may allow an attacker to gain access to sensitive information that could be used to launch further attacks against a system.
Tritanium Bulletin Board version 1.2.3 has been reported to be prone to this issue, however other versions may be affected as well.
It has been reported that Tritanium Bulletin Board may be prone to an access validation error that may allow a remote attacker to to gain unauthorized access to threads. A remote attacker may be able to access sensitive data by modifying the URL and supplying a value for thread_id, forum_id, and sid paremeters.
Successful exploitation of this issue may allow an attacker to gain access to sensitive information that could be used to launch further attacks against a system.
Tritanium Bulletin Board version 1.2.3 has been reported to be prone to this issue, however other versions may be affected as well.
Exploit / POC
Tritanium Scripts Tritanium Bulletin Board Unauthorized Access Vulnerability
The following proof of concept has been provided:
http://www.example.com/[path]/index.php?faction=reply&thread_id=[ID OF THE THREAD TO READ]&forum_id=[ID OF FORUM]&sid=[your sid]
The following proof of concept has been provided:
http://www.example.com/[path]/index.php?faction=reply&thread_id=[ID OF THE THREAD TO READ]&forum_id=[ID OF FORUM]&sid=[your sid]
Solution / Fix
Tritanium Scripts Tritanium Bulletin Board Unauthorized Access Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Tritanium Scripts Tritanium Bulletin Board Unauthorized Access Vulnerability
References:
References:
- Product Homepage (Tritanium Scripts)