Authorization bypass through predictable unsubscribe token in Popup Builder

Popup Builder generates newsletter unsubscribe tokens as an MD5 of the subscriber ID and e-mail address, a value an attacker can reproduce. An unauthenticated attacker who knows a subscriber's e-mail address can brute-force the sequential subscriber ID to forge a valid unsubscribe link and remove that person from the site's mailing list without... Weiterlesen