Delete profile comments on anyone's profile made by anyone

Printable View

12 Dec. 2014, 01:36am
Blaze

Delete profile comments on anyone's profile made by anyone

So I just discovered this by accident because I wanted to delete a comment I had made on someone's profile.

I used the postman addon for chrome.

You take the base url for deleting comments on profiles:

gaiaonline.com/p/xxxxxx/?mode=deletecomment&cid=xxx

insert the commentid and the user id in the x's. (you can find the cid if you hover over the "report post" link, and it will have the userid_cid (ex. gaiaonline.com/gaia/report.php?r=30&rpost=999999_99)

Then, go into postman and put the url together in there. Then click the dropdown box to the right, and select "post".

Form should appear below with "key" and "value"

Under key, put "submit". Under value, put "Yes".

Comment will be deleted. You can use this to delete a comment made by anyone on anyone's profile. You could go to an admin's page if you wanted to and delete all the comments off of their profile.

Not sure how useful this would be to others, but it was entertaining, so I figured I would share.
12 Dec. 2014, 02:06am
Kingz V

+rep nice post
12 Dec. 2014, 07:03am
GAMEchief

This sounds very insecure, and even the most basic of security should block it, so I'm curious if it works.
12 Dec. 2014, 04:16pm
Blaze

Quote:

Originally Posted by GAMEchief

This sounds very insecure, and even the most basic of security should block it, so I'm curious if it works.

It works. I know it works, because I did it. Just try it :)
12 Dec. 2014, 09:16pm
The Unintelligible

Interesting discovery. I don't play gaia anymore but even if (or when rather) this gets patched, the method behind doing this is still pretty useful info.

+rep
15 Dec. 2014, 08:26pm
Omlett

Quote:

Originally Posted by The Unintelligible

Interesting discovery. I don't play gaia anymore but even if (or when rather) this gets patched, the method behind doing this is still pretty useful info.

+rep

Maybe if you can force comments to delete you can force other actions too.
15 Dec. 2014, 11:08pm
tantantan

Quote:

Originally Posted by Omlett

Maybe if you can force comments to delete you can force other actions too.

Shall we begin to test this theory?
17 Dec. 2014, 12:48pm
Blaze

Quote:

Originally Posted by Omlett

Maybe if you can force comments to delete you can force other actions too.

That's what I was wondering. Haven't figured out what I want to test yet, though.
17 Dec. 2014, 09:47pm
Omlett

Quote:

Originally Posted by Blaze

That's what I was wondering. Haven't figured out what I want to test yet, though.

Try to force accept trade for another person is the first thing that came to my mind.
24 Dec. 2014, 06:21pm
A terrible taste

Quote:

Originally Posted by Blaze

That's what I was wondering. Haven't figured out what I want to test yet, though.

I wonder if you can delete forum post that other users made as well.

Also, have you tried to edit comments by doing the same thing?

either way, impressive find.
27 Dec. 2014, 06:28pm
Zerovirus

Omlett beat me to it, but I was thinking the same thing. That could possibly be imitated for forums, though it might not work since (as far as I know), posts aren't given a userid.

It could be even possible to force purchases of items without losing any gold on your side, but having the gold delivered to the seller. Maybe. I'm just spitballing.
28 Dec. 2014, 01:10am
Kitsune

Hate to shoot you guys down but a few years ago someone found a similar exploit with the Art Arenas in Gaia.
So it could possibly still work with that, but forcing trades/market/forum actions more than likely won't work.
29 Dec. 2014, 05:20am
Izaya

Was this never patched? Cos fairly sure it was abused all to hell ages ago by several people from another forum I used to be a part of.
29 Dec. 2014, 08:19am
Blaze

Doesn't work with forums, throws a permissions error page out.

Haven't tried it with anything else yet.
09 Feb. 2015, 06:38am
Zerovirus

Has anyone figured out if this extends to any other areas rather than comments?

I did try trades and marketplace purchases, but nothing happens.
10 Feb. 2015, 01:42am
Kitsune

Quote:

Originally Posted by Zerovirus

Has anyone figured out if this extends to any other areas rather than comments?

I did try trades and marketplace purchases, but nothing happens.

Quote:

Originally Posted by Kitsune

Hate to shoot you guys down but a few years ago someone found a similar exploit with the Art Arenas in Gaia.
So it could possibly still work with that, but forcing trades/market/forum actions more than likely won't work.

^
12 Feb. 2015, 03:22am
Lysergic Delights

+rep. I've known about this for years and finally somebody else found it, congrats. I wrote a php script to do it for you and a ruby one at one point.

Quote:

Originally Posted by Izaya

Was this never patched? Cos fairly sure it was abused all to hell ages ago by several people from another forum I used to be a part of.

Nah it was never patched I was the only one really using it. But hey, you remember the php script I wrote I'm sure.
21 Feb. 2015, 08:23pm
ZeroSan

Quote:

Originally Posted by Kitsune

Hate to shoot you guys down but a few years ago someone found a similar exploit with the Art Arenas in Gaia.
So it could possibly still work with that, but forcing trades/market/forum actions more than likely won't work.

I was that "someone" who found the similar exploit for the Art Arenas.
I posted it on EBU many years ago, and Larry (I believe that was his name) volunteered to make it on a some command line program for me.

Anyways, congrats OP for figuring it out.
21 Feb. 2015, 09:52pm
The Unintelligible

Quote:

Originally Posted by ZeroSan

I was that "someone" who found the similar exploit for the Art Arenas.
I posted it on EBU many years ago, and Larry (I believe that was his name) volunteered to make it on a some command line program for me.

Anyways, congrats OP for figuring it out.

LOL @ Larry. Larry as in Larry Bird, eh?

Anyways, name was Lan, but yeah I remember making that program for you a while ago. I got banned a few times while testing it (lol) but I suppose it was worth it for the end product.

I kinda remember you. What brings you to LG?
12 Mar. 2015, 06:44pm
iAMCEEJAY

Lol I think this has been patched
11 Feb. 2018, 11:36am
Dhacker

ow