Description
user.php in BoastMachine 3.0 platinum allows remote authenticated users to gain privileges via a modified id parameter, as demonstrated by an edit_post action.
References
- 41027 vdb-entry
- boastmachine-login-user-session-hijacking(34462) vdb-entry
- 2736 third-party-advisory
- 24096 vdb-entry
- 20070522 BoastMachine v3.0 platinum - Session Ýd Hacking mailing-list