SpaceDev/SpaceBukkit — Issue #133: new vulnerability in spacebukkit 
Author: N3XT0R
Created: 2012-02-26 21:20:10+00:00
State: open

Hello guys,

in spacebukkit is a vulnerability ;)

guests can create new users(super admins or normal users).

http://[host]/users/add

here can a guest go to the user add page and see the user add form.
So if he or she click on the submit button after fill the required fields, there
will be an exception....

but...
if they write a little html script like:

http://pastebin.com/w0XS3nLS

They can create a new admin or other user.

On submit will shown "access denied" but the user is in this moment created and a login with the new user is possible. ;)

fix it :)