Re: Fairly serious vulnerability in vBulletin 2.2.0

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Thu, Jan 31, 2002 at 04:18:23AM -0000, HarryM wrote:

> Solution:
> Ensure that $bbuserid, $bbpassword, and the rest of the cookied variables
> are coming from the cookie and not from GET or POST data, by using the
> $HTTP_COOKIE array.

Unfortunately, this is nothing more than a workaround too. It's trivial to
create your own cookie jar with the appropriate data.

-- 
Sam Sargeant <samat_private> 
------------------------------------------------------------------------
 "The whole problem with the world is that fools and fanatics are
  always so certain of themselves, and wiser people so full of doubts."
                                              - Bertrand Russell

• application/pgp-signature attachment: stored

• Next message: Devrim SERAL: "Re: tac_plus version F4.0.4.alpha on at least Solaris 8 sparc"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Jan 31 2002 - 15:18:53 PST