Rockstar Games: XSS on rockstargames.com

Vulnerability description not provided...

Rockstar Games: Source Code Disclosure (CGI)

Hello guys. I would like to share with you my discovery. The fact is that at: https://www.rockstargames.com/gta/game/highscores.cgi Anyone can see the source code of the script F166966 check please Regards @d1v3r...

Rockstar Games: Control Character Injection In Messages

This report involved the injection of control characters, such as Null Byte 0x00, into vulnerable fields in the Message endpoints in order to cause unexpected, harmful behaviors. Our solution was to both block control characters from being saved on the backend when included in user-input, as well...

Rockstar Games: Unserialize leading to arbitrary PHP function invoke

In this report, the researcher was able to demonstrate a method to run arbitrary PHP functions on www.rockstargames.com. Although we had previously disabled most harmful PHP functions, it was still possible to cause serious damage if this were to be exploited by a malicious party. To solve this...

Rockstar Games: Bypass CAPTCHA protection

In this report, the researcher found that it was possible to bypass our CAPTCHA check by injecting a random value into the X-Forwarded-For header in the sign in POST request. At the time the researcher submitted this report, we only enforced CAPTCHA checks on sign-in requests that had failed...

Rockstar Games: SSLv3 POODLE Vulnerability

Tested against POODLE MITM and www.rockstargames.com is vulnerable, i simply went into terminal and used this command "openssl sclient -connect www.rockstargames.com:443 -ssl3" proof attached in image below How to fix: Disable SSLv3...

Rockstar Games: full path disclosure on www.rockstargames.com via apache filename brute forcing

In this report, the researcher found that sending a request with an invalid Accept header to http://www.rockstargames.com/index resulted in a full path disclosure to the webroot. This was fixed as a result of the researcher's aid. Please be aware that after this report was resolved, we added "Pat...

Joomla StreetGuessr Game 1.0 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component StreetGuessr Game v1.0 - SQL Injection Google Dork: inurl:index.php?option=comstreetguess Date: 02.03.2017 Vendor Homepage: https://www.nordmograph.com/ Software:...

Joomla! Component StreetGuessr Game 1.0 - SQL Injection

Joomla! Component StreetGuessr Game 1.0 - SQL Injection Exploit Title: Joomla! Component StreetGuessr Game v1.0 - SQL Injection Google Dork: inurl:index.php?option=comstreetguess Date: 02.03.2017 Vendor Homepage: https://www.nordmograph.com/ Software:...

papas-games.com XSS vulnerability

Vulnerable URL: http://www.papas-games.com/games.php?subaction=showfull=1385049120=1%27"--!& Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1772001 VIP website status:| No Check...

Joomla! Component Soccer Bet 4.1.5 - cat SQL Injection

Joomla! Component Soccer Bet 4.1.5 - cat SQL Injection Exploit Title: Joomla Component Soccer Bet 4.1.5 - SQL Injection Date: 2017-02-11 Home : https://extensions.joomla.org/extensions/extension/sports-a-games/tips-a-betts/soccer-bet/ Exploit Author: Persian Hack Team Discovered by : Mojtaba Mobh...

серьёзныеигры.рф Open Redirect vulnerability

Vulnerable URL: http://серьёзныеигры.рф/forum/away.php?s=http://openbugbounty.org Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 131437 VIP website status:| No Coordinate...

ICGames Games Site Script 1.2 SQL Injection

Exploit Title: ICGames-Games Site Script - Authentication Bypass Google Dork: N/A Date: 20.01.2017 Vendor Homepage: http://www.icloudcenter.com/ Software Buy: http://www.icloudcenter.com/games-site-script.htm Demo: http://www.icloudcenter.net/demos/icgames/ Version: 1.2 Tested on: Win7 x64 Exploi...

ICGames-Games Site Script 1.2 - Authentication Bypass

ICGames-Games Site Script 1.2 - Authentication Bypass Exploit Title: ICGames-Games Site Script - Authentication Bypass Google Dork: N/A Date: 20.01.2017 Vendor Homepage: http://www.icloudcenter.com/ Software Buy: http://www.icloudcenter.com/games-site-script.htm Demo:...

ICGames-Games Site Script 1.2 - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title: ICGames-Games Site Script - Authentication Bypass Google Dork: N/A Date: 20.01.2017 Vendor Homepage: http://www.icloudcenter.com/ Software Buy: http://www.icloudcenter.com/games-site-script.htm Demo:...

Kizi - Cool Fun Games - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Kizi - Cool Fun Games published at the 'play' market has multiple vulnerabilities...

games.espn.com XSS vulnerability

Vulnerable URL: http://games.espn.com/ffl/%22%3E%3Cimg%20src=x%20onerror=confirm%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 14:01 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

Rockstar Games: [IMP] - Blind XSS in the admin panel for reviewing comments

@anshumanbh discovered that it is possible to exploit a Blind XSS vulnerability under the "MOUTHOFF TO ROCKSTAR" section while providing feedback. The result is a XSS vulnerability being exploited on an internal Rockstar Games domain. The way this worked was that an attacker would submit a...

ut2004stats.epicgames.com XSS vulnerability

Vulnerable URL: http://ut2004stats.epicgames.com/index.php?stats=servers Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Coordinated...

Rockstar Games: Ability to post comments to a crew even after getting kicked out

The researcher found that under certain conditions, Crew members were still able to perform particular actions, such as posting on the Crew wall, even after being kicked from the Crew. Additional verification checks were put in place to prevent this behavior. TL;DR - Members who got kicked out of...