Jump to content


Photo
- - - - -

Everyone can watch private videos


  • Please log in to reply
No replies to this topic

#1 fooktube

fooktube

    Member

  • Members
  • PipPip
  • 24 posts

Posted 15 November 2015 - 01:31 PM

Yesterday I found that there is big security bug in script. Everyone can see private videos.

 

Here is how:

 

All you need to do is first of all, go to a private video and get the 4 digit number.

Now take the 4 digit code and use it with this url:

http://www.yoursite.com/mobile_src.php?id=CODE

Wait few seconds and voala you can see private videos now.

 

I found this after my visitors started disqus about it on social sites.

 

How can we fix it please?


Edited by fooktube, 15 November 2015 - 01:32 PM.