Account Information Leakage, vIa cookie

[UnSaKreD]

As you all well know, Yahoo! is promoting their new messenger by using Hoobastank and some meat lol.

You must enter the promotion by going to,

http://promotions.yahoo.com/add5friends/ud/enter.html

If you are already logged in you will see that this information is already filled out.

(hence our problem)

With a simple get request to the forementioned page, and a user(s) cookie.

It is possible to grab personal information from the account.

This is not the first, nor most likely the last time this will happen.

So quick recap.

1.) Hoobastank promotion contains personal account information.
2.) Simple Get Request with the users cookie, will display this information. No password needed, since we are using cookies, and yahoo! relies heavely on them.

Thats it.