[CLOSED] SOE's implementation of Lithium Forums Software allows users to log on as each other.

[support]

This issue has been resolved as of 5/23/2006.  The problem was related to the 
customer-specific implementation of the user authentication system and is not a 
general problem with Lithium’s software.  This does not affect any of Lithium’s 
other customers.

SOE's implementation of Lithium Forums Software allows users to log on as each other.

[john]

Original bug/exploit was sent to Sony Online Entertainment December 5th (5 
months ago)

They havent fixed it yet.

You can read details here: 
http://johnhasson.com/blog/archive/2006/05/18/175.aspx


Summary:

When logging into the forums (tested with the Matrix Online game forums) your 
sessionid is passed along the URL.  And images/etc that link to other websites 
pass this URL along as the referrer.  This URL can be used to log in as that 
person with out any authentication.


Lithium has been contacted directly by me about this.  I am waiting to hear 
back from then.  SOE was also contacted it has not been fixed (5 months now) 
but they did say they would "pass it along"


Forum Link:

https://secure.station.sony.com/login/login/station/login_no_popup.jsp?returnURL=http%3A%2F%2Fmxoboards.station.sony.com%2Fmatrix%2F