Three Years of Service
Posts: 6
Threads: 4
Do you remember your first vulnerability you found? 11-03-2023, 04:34 PM
#1
What was it? Tell us something about it
β’
Fourteen Years of Service
Posts: 18,865
Threads: 2,029
RE: Do you remember your first vulnerability you found? 11-03-2023, 05:29 PM
#2
Not my first, but there was an older trick with MyBB's Merge System. Typically when forums were acquired/merged, this tool was used to consolidate the databases. The caveat was that in the early days, there was no authorization required to use it on a board's installation. This allowed unauthorized users to merge a remote database, adding administrators or other properties to the board.
Provided a forum used the feature before, it was as simple as visiting /merge/ and using an empty remote MyBB database. Back then it was pretty common for larger boards to be acquired/merged, so plenty would leave the /merge/ directory in tact. Made for some great targets. MyBB has since added authentication to the Merge System, so it can't be used by regular visitors.
β’