Vulnerability was fixed in https://www.e-gold.com/acct/confirm.asp money transfer script. Problem description: If authenticated user is referred to the script AccounID/PassPhrase validation is not performed. By redirecting user to URL https://www.e-gold.com/acct/confirm.asp?AccountID=123456&PassPhrase=somestring&PayeeAccount=MY_ACCOUNT&Amount=100&PAY_IN=1&WORTH_OF=Gold&Memo=Donation&IGNORE_RATE_CHANGE=y it's possible to transfer money to another account without validation. On march, 13th 2006 reported to e-gold On march, 14th 2006 fixed Details posted on http://bhunter.awardspace.com/vuln-en.html I did get a small "buggs bounty" from e-gold for this info.
