mybb-disclose.txt

`##################################################################################  
#MyBB 1.4.3 my_post_key Disclosure Vulnerability by NBBN   
(http://nbbnsblog.co.cc)   
#  
##################################################################################  
  
Vendor: http://mybboard.net  
Date: November 25, 2008  
  
These URLs contains "my_post_key". Moderators and admins use these   
sometimes, depending on what they want to do with a thread.  
my_post_key is used to perform various actions and to prevent CSRF.  
  
  
These pages shows the posts of the users. If some of these posts have   
pictures, the referrer will be transfered to the server of the images.  
#####Vuln   
URLs#################################################################################  
http://localhost/mybb/moderation.php?action=mergeposts&tid=1&modtype=thread&my_post_key=[key]   
#  
http://localhost/mybb/moderation.php?action=split&tid=1&modtype=thread&my_post_key=[key]   
#  
http://localhost/mybb/moderation.php?action=deleteposts&tid=1&modtype=thread&my_post_key=[key]   
#  
############################################################################################   
  
  
  
Finally, an attacker has the postkey, and can perform some interesting   
moderator or administrator actions with csrf.  
`