aaronstatic/spacegame-public — Issue #31: Exploit: See position of all fleets in the game, including ones that aren't mine!
Author: duk3luk3
Created: 2011-10-18 14:40:36+00:00
State: open

/data/fleetmarketsell has an argument enumeration weakness that allows me to put arbitrary values into fleet_id and (apparently) get valid data back no matter whether the fleet belongs to me or not.

Reproduce:

- log into game
- open spacega.me/data/fleetmarketsell?item=food&fleet_id=555 (or any other fleet_id)
- look at the goodies!

Using the distance data returned and the known locations of star systems, it is trivial to triangulate the position of the fleet.