Reusing Exploits to Hijack Tower of Fantasy Accounts

A while back, I had discovered two unpatched zero-day vulnerabilities in Neverness to Everness that can be changed for full account takeover.

Since then, I wanted to see if Tower of Fantasy, another game created by Hotta Studio, had the same vulnerabilities, and it does!

These were responsibly disclosed to Perfect World / Hotta Studio, but remain unpatched over 130 days of disclosure with CVEs still pending.

Thankfully, there aren't enough players anymore for this to ever be realistically exploitable :)