On Thu, 24 Mar 2005, Woody wrote: > Hi, > > I've found a bug in Invision Board, it let's you send private messages > around, change people their signature, avatar, etc. > > If the administrator doesn't filter all the html tags on a forum (or just > forgets, which is often the case) you can add an invisible iframe to your > post. Now if you just figure out how invision board sends for example a > private message, you can let people send one to someone.
Just out of curiosity, which version of the software did you test this on, and which if any are immune? -- Sincerely, Paul Laudanski .. Computer Cops, LLC. CastleCops(SM)... http://castlecops.com CC Blog ......... http://blog.castlecops.com Staff Blogs ..... http://busterbunny.castlecops.com Our Vision ...... http://castlecops.com/postt63382.html http://cuddlesnkisses.com http://justalittlepoke.com http://zhen-xjell.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
