Tooltip Manipulation

Started by MightyGoober [812478] on 22 Feb 2018 in Bugs & Issues.

14 replies · 326 views · thread synced 23 Sep 2026 · 7 days ago · View on torn.com

About this thread

Posts archived: 15 / 15 posts (100%) · the total is Torn's reply count + the opening post at the last fetch

Counted by TornLife from the archived posts.

Archived posts: 15
Discussion span: 22 Feb 2018 → 27 Feb 2018
People posting: 11
Likes on archived posts: 20
Posts by staff, officers and moderators: 2
Authority score: 59 / 100
Historical score: 37 / 100
Story score: 48 / 100
Engagement score: 64 / 100

Most-liked replies

saeed [1826888] · 6 likes · 24 Feb 2018
Definitely should have gone about this differently. Generally speaking, PMing a staff member about any possible exploits/injections is the best method... not telling everyone that may want to harm users that it's possible is not the best idea. next thing …
aurel1 [1046304] Admin · 4 likes · 24 Feb 2018
Tooltip is temporarily disabled, proper fix will be live with next update.
Xepa4ep [1720900] Admin · 2 likes · 27 Feb 2018
fixed, will be with next LIVE

MightyGoober [812478] 22 Feb 2018, 18:30 TCT · #1 · edited

Hello "

Hover over threads that contain quotes. The javascript is not blackslashing special characters. Not sure if any type of injection attack would be possible (probably not, as it's only javascript). But worth looking into.

See:

[image: i.imgur.com]

And this thread is going to say Hello because it stops reading it after the quote.

Tired of my reporting yet?

Grif [882958] 22 Feb 2018, 18:33 TCT · #2

i see what you are saying

ill pass it to xeap to have a look

MightyGoober [812478] 23 Feb 2018, 21:13 TCT · #3 · edited

Bump - Might wanna move this up the priority as injection is possible. (Look at my new title)

Hcom3 [2003693] 23 Feb 2018, 21:26 TCT · #4

I went to B&I saw the title and thought.... What the hell?

[image: i.gyazo.com]

MightyGoober [812478] 23 Feb 2018, 21:32 TCT · #5

Attempting to inject javascript now.

I won't go to fed for stress-testing a bug right?

lmao

Revis [1893023] 23 Feb 2018, 21:39 TCT · #6 · edited

https://imgur.com/a/xwhdF

Looks like this is very exploitable- this just popped up when I clicked on this thread

Proxima [1879587] Wiki Editor 23 Feb 2018, 21:47 TCT · #7

yeah, wow. Couldn't even navigate beyond that popup.

HaroldShipman [89686] 23 Feb 2018, 21:58 TCT · #8

Fed him for this. Thanks :P

saeed [1826888] 24 Feb 2018, 06:36 TCT · #9

Definitely should have gone about this differently. Generally speaking, PMing a staff member about any possible exploits/injections is the best method... not telling everyone that may want to harm users that it's possible is not the best idea. next thing you know, i'm redirecting you to pornhub.

just sayin.

PMV [1577993] 24 Feb 2018, 07:23 TCT · #10

Agreed. It's likely they're now gone for the weekend so wont even see this until Monday. That's a hell of a lot of time for bads to figure this out and exploit it.

aurel1 [1046304] Admin Staff 24 Feb 2018, 09:19 TCT · #11

Tooltip is temporarily disabled, proper fix will be live with next update.

Ahab [1735214] 24 Feb 2018, 11:46 TCT · #12 · edited

Is a point where full disclourse is best and what this could do was already posted just nothing was done.

saeed [1826888] 24 Feb 2018, 19:14 TCT · #13

I'm saying the thread never should have existed. :P not the place to argue though. full disclosure of exploits is also never a good idea period

MightyGoober [812478] 24 Feb 2018, 23:18 TCT · #14

The tooltips have been disabled and the javascript removed from my post.

Xepa4ep [1720900] Admin Staff 27 Feb 2018, 08:21 TCT · #15

fixed, will be with next LIVE