▄▄             ▄▄▄  ▄▄▄ Power
█  █ ▄▄▄▄ ▄▄▄▄▄ █  █ █  █
█▄▄█ █▄▄▄ █ █ █ █▀▀▄ █▀▀▄
█  █ ▄▄▄█ █ █ █ █▄▄▀ █▄▄▀

Login
Register
/ aa about.it ad amd64 and.who api asm asmbb asmbb.features authentication bbcode best bugs cares chat common debian deck design dll docker email embed fast feature files fossil fresh.ide friendly gamedev heap help hiawatha i18n incredible interop learning libfresh limit links linux mailing.list meme meta.http-equiv minimag money mysql neo nginx numbers orly os outage pass password post-by-email programmers programming proile read-by-email resources safety script.alert.xss secret seo skins sodom source sourcecode subdirectory subforum support tags templates test test123 type very.ugly video work xss игнат котики парола русский тест уеб.програмиране хабр.наполеон
Categories Threads

Minor but annoying CSRF bug fixed. RSS

A minor, but annoying CSRF vulnerability has been fixed. It allowed an attack on /!logout function through image tags. Such as below:

[!/!logout][Attack image]
The attack image

Attack image

Of course, now it is safe.

Updating the engine and the templates is recommended.

The changed files can be seen here: https://asm32.info/fossil/repo/asmbb/info/42032b0a862fccd3. Notice how the logout link is replaced by a form and submit button, styled as an ordinary link.

johnfound

A minor, but annoying CSRF vulnerability has been fixed. It allowed an attack on /!logout function through image tags. Such as below:

[!/!logout][Attack image]
The attack image

Attack image

Of course, now it is safe.

Updating the engine and the templates is recommended.

The changed files can be seen here: https://asm32.info/fossil/repo/asmbb/info/42032b0a862fccd3. Notice how the logout link is replaced by a form and submit button, styled as an ordinary link.

hi,

i can not find below files

Modified source/accounts.asm Modified source/ToDo.txt

AsmBB v2.6 (check-in: f15fadce65c1fa6d); SQLite v3.28.0 (check-in: 884b4b7e502b4e99);

©2016..2018 John Found; Licensed under EUPL.
Powered by Assembly language
Created with Fresh IDE

Icons are made by Egor Rumyantsev, vaadin and icomoon from www.flaticon.com