my thoughts on forum security
-
i wanted to write about some security issues which many forums suffer from and have yet to be fixed. this isnt a callout post or anything, i just find it interesting. any details on specific forums, vulnerabilities, or specific software will be redacted until its fixed.
quite frankly, forum security - like any other types of security - SUCKS HORRIBLYYY. there is a large forum vendor which is riddled with vulnerabilities, to give you context here are vague summaries of the vulnerabilities ive found in certain forum software:
- broken access control: any moderator, without the right privileges, is able to see user's data which should only be limited to admins.
- any user is able to grab another user's ip address, without any interaction or alert.
- any user is able to upload files which are prohibited.
keep in mind, i only spent like.. an hour or two, doing a basic audit of the web interface part - i didnt even disassemble and decompile the binaries for potentially more serious vulnerabilities. and ofc, i reported all vulnerabilites to the vendor (which they claim they reply and triage within 24 hours - but its taking weeks
)the point is. uhhhm. there is no point, just be careful online.
-
do you know any good forums that arent this one? like ones for every device ofc
@pawthetic ummmmmm. no x.x im not familiar with many forums, i just look into the underlying software
-
@pawthetic ummmmmm. no x.x im not familiar with many forums, i just look into the underlying software
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better π
Register Login