MkPortal Urlobox Cross Site Request Forgery

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: MkPortal Urlobox Cross Site Request Forgery
From: info@xxxxxxxxxxx
Date: 19 Dec 2006 22:27:27 -0000
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm

MkPortal Urlobox Cross Site Request Forgery

Discovered by: Demential
Web: http://www.burnhead.it
E-mail: info@xxxxxxxxxxx
Mkportal website: http://www.mkportal.it

posting [img]?ind=urlobox&op=delete&idurlo=X[/img] in MkPortal urlobox
where X is an ID of a message,
when administrator opens urlobox page
message X will be erased.

Prev by Date: Multiple Bugs in MINI WEB SHOP
Next by Date: RE: Cisco not honoring update promises?
Previous by thread: Multiple Bugs in MINI WEB SHOP
Next by thread: Re: MkPortal Urlobox Cross Site Request Forgery
Index(es):
- Date
- Thread