2 points | by hunio 7 hours ago ago
2 comments
A while back, I had discovered two unpatched zero-day vulnerabilities in Neverness to Everness that can be changed for full account takeover.
Since then, I wanted to see if Tower of Fantasy, another game created by Hotta Studio, had the same vulnerabilities, and it does!
These were responsibly disclosed to Perfect World / Hotta Studio, but remain unpatched over 130 days of disclosure with CVEs still pending.
Thankfully, there aren't enough players anymore for this to ever be realistically exploitable :)
A while back, I had discovered two unpatched zero-day vulnerabilities in Neverness to Everness that can be changed for full account takeover.
Since then, I wanted to see if Tower of Fantasy, another game created by Hotta Studio, had the same vulnerabilities, and it does!
These were responsibly disclosed to Perfect World / Hotta Studio, but remain unpatched over 130 days of disclosure with CVEs still pending.
Thankfully, there aren't enough players anymore for this to ever be realistically exploitable :)