Found a way to trigger admin level login on the site

Send Νυdes·1/25/2016, 12:34:43 AM·1 votes·309 views
http://i.imgur.com/5z46lBV.jpg

On a normal account you can't trigger this, but if you start a new account and login on to the site, before you login in to the game, the account will be nameless and site perceives it as IDless and it triggers the login, the account i was on had the email already confirmed, dunno if it changes anything or not. It's really hard to isolate the login and there's a limit of a 100 tries every 5 minutes, but someone can definitely exploit this. This triggers for about 5 seconds on every page under sales. After it goes away, all you have to do is reload the page and the login appears again.

So...

  • Create new account, login to the site and confirm mail (Do not login with this account in to the game);
  • Go to any article under /sales/;
  • Login window will appear in every article and every time you refresh for about 5 seconds.

Since this is a rather serious bug, if you want to show some gratitude to me, i'll be acepting a free name change on this account, ty ty. Good night.

0 Comments