Rage at Autodesk

[Deleted member 77746]

i have contacted BBC News with relevant info ..... watch this space.

 

[flibbage0]

rexel I'm not clicking on that because I'm a wuss, but is that what I think it is?

 

[rexehuk]

rexel I'm not clicking on that because I'm a wuss, but is that what I think it is?

Password reset function with no "old password" validation. You'd need to know how to exploit it however.

 

[dfarrall]

rexel I'm not clicking on that because I'm a wuss, but is that what I think it is?

Click it and find out

Its an admin password change, you dont need to enter old password.

 

[burns]

I wonder if their admin has just received a number of emails saying their password has been changed and is wondering wtf is going on.

Probably not.

 

[Deleted member 77746]

Click it and find out

Its an admin password change, you dont need to enter old password.

I changed it to password. These are forms that probably won't work regardless if they are not in a site structure.

 

[dowie]

Password reset function with no "old password" validation. You'd need to know how to exploit it however.

I still think the logs are more worrying as they affect individuals

http://au.autodesk.com/ama/accessdebug.txt.tmp

24 mb file - just search 'confirm_password' - plenty of people's passwords and e-mails addresses freely published by autodesk...

 

[rexehuk]

I changed it to password. These are forms that probably won't work regardless if they are not in a site structure.

I'm thinking possibly internal and used in the internal network only... I am going to leave the site be now, good job on the BBC email.

I did come across a text file with user accounts in the backup folder, it has a boolean for card_details, meaning they may well store them as well. IF they are on the same server they could well be in breach of card storage laws and be in for a serious ass kicking.

 

[Skillmister]

This makes me glad i hadnt forked out for a legit copy of 3ds max

 

[Messiah Khan]

http://au.autodesk.com/editor/mod.admin/admin_user_manager_detail.htm

Anyone want to set up a new account with admin rights?

 

[teaboy5]

10 notes they are trolling us and now have a list of all our IP's

 

[asim18]

10 notes they are trolling us and now have a list of all our IP's

lol.

 

[teaboy5]

lol.

Wee joke relax yourself! lol

 

[Deleted member 77746]

Talk about email harvesting.
'emailaccounts.txt'

 

[TNGL]

There are probably hundreds, if not thousands who are looking through these files lol.

 

[Skillmister]

http://au.autodesk.com/editor/mod.admin/admin_user_manager_detail.htm

Anyone want to set up a new account with admin rights?

 

[rexehuk]

I'm not sure what they'd do with IP addresses... we haven't breached anything. If that's the case they'll have to sue google too, as they have the whole thing indexed .

The admin folder wont work afaik, unless you can change the source code to match the destination intended, however I doubt (or hope) that isn't publicly accessible.

 

[Macky]

http://au.autodesk.com/editor/mod.admin/admin_user_manager_detail.htm

Anyone want to set up a new account with admin rights?

The **** happens to my mouse when I go on that? Goes all jerky and laggy.

Hmm doesn't now. I'm not setting an account up by the way..

 

[Messiah Khan]

http://au.autodesk.com/editor/mod.admin/mod.manage/fragment_site_configuration_manage.htm

Still need a username and password to get in, but eek!

 

[Pho]

http://au.autodesk.com/editor/mod.admin/admin_user_manager_detail.htm

Anyone want to set up a new account with admin rights?

It's just a template, you need to know where to post the form to (at the moment it doesn't go anywhere).

I think this site was made by Digital Cheetah - there's a few references to them, and the acronym dc around the site.