# Website: www.ticketgenie.in
# Date: 18.10.11
# Bug: XSS / SQLi / Multiple Vulnerabilities
###############################################
Special advisory dedicated to all metal heads and headbangers from all over the world. The concert tickets for Metallica's show at Bangalore, Palace grounds is available at TicketGenie website... The tickets started getting sold publicly 3 days back according to a news website. So you can pay for the ticket or get it for FREE :D
How many tickets do you want? :))
Want to track other people's tickets?
BONUS: Login page is vulnerable to bruteforce attacks, since there is no account lockout mechanism
We have not included Proof-of-Concept demonstrations as with other posts, since the pages can be abused to buy free tickets :))
A website which deals with financial information should be better protected than this... I am NOT going to trust Ticket Genie with my credit card, unless they show some improvement with security.
Cheers,
Kish
2 comments:
ow can I get in touch with you? Need help unmasking someone. Can you help?
You can write to me: kishfellow at yahoo dot com
Post a Comment