Solidot: eBay日本论坛的用户密码是用户名+123456

Solidot

奇客的资讯，重要的东西

eBay日本论坛的用户密码是用户名+123456
http://solidot.org.feedsportal.com/c/33236/f/556826/s/38b5b555/sc/21/l/0L0Ssolidot0Borg0Cstory0Dsid0F38916/story01.htm
Mar 28th 2014, 07:22

eBay日本修复了一个安全漏洞，这个漏洞允许任何人能访问任意注册用户的论坛帐号。eBay日本的论坛程序是phpBB，它的身份认证系统在服务端没有和网站整合起来，而是另用一套独立的系统，开发这套系统的人实现了一个硬编码的论坛密码：用户名+123456，在社区论坛验证用户身份是用eBay登录页发出一个隐藏的POST请求。这一实现意味着任何人可以在论坛上冒充其他人，但并不能控制用户在eBay日本的主帐号。This entry passed through the Full-Text RSS service — if this is your content and you're reading it on someone else's site, please read the FAQ at fivefilters.org/content-only/faq.php#publishers.



You are receiving this email because you subscribed to this feed at https://blogtrottr.com

If you no longer wish to receive these emails, you can unsubscribe here:
https://blogtrottr.com/unsubscribe/cz0/jPbdSR