+- Sinisterly (https://sinister.ly)
+-- Forum: General (https://sinister.ly/Forum-General)
+--- Forum: The Lounge (https://sinister.ly/Forum-The-Lounge)
+--- Thread: Do you remember your first vulnerability you found? (/Thread-Do-you-remember-your-first-vulnerability-you-found)
Do you remember your first vulnerability you found? - Rockabye - 11-03-2023
What was it? Tell us something about it
RE: Do you remember your first vulnerability you found? - Oni - 11-03-2023
Not my first, but there was an older trick with MyBB's Merge System. Typically when forums were acquired/merged, this tool was used to consolidate the databases. The caveat was that in the early days, there was no authorization required to use it on a board's installation. This allowed unauthorized users to merge a remote database, adding administrators or other properties to the board.
Provided a forum used the feature before, it was as simple as visiting /merge/ and using an empty remote MyBB database. Back then it was pretty common for larger boards to be acquired/merged, so plenty would leave the /merge/ directory in tact. Made for some great targets. MyBB has since added authentication to the Merge System, so it can't be used by regular visitors.