Jump to content

Recommended Posts

Ok guys. First off,

 

http://beta.imuzic.co.uk/phpfreaks.txt (I'm going to remove this in 24 hours - I don't like unused text files in my directory :P

 

Right. I have been working on this b-e-a-utiful website, iMuzic. It is a music sharing service with user accounts, playlists, downloads, etc. There are two versions - Full and Static. Full version uses AJAX. Static version is pure PHP and HTML. I need you to test out both for SQL injections, etc.

 

Oh, and you can take a look at the site and the Shuffle section too. That's a work in progress application. Thanks.

Link to comment
https://forums.phpfreaks.com/topic/174608-imuzic-need-proper-testing/
Share on other sites

Is it normal that their are songs that do not work?

=> It is not that clear that the songs in red arent working.

Why are they actually listed if you can't hear them?

 

For the rest:

 

It's very easy to use, (Full version), The design is simple but I like it.

 

And the ammount of mp3's available is amazing :o!!

Is it normal that their are songs that do not work?

=> It is not that clear that the songs in red arent working.

Why are they actually listed if you can't hear them?

 

For the rest:

 

It's very easy to use, (Full version), The design is simple but I like it.

 

And the ammount of mp3's available is amazing :o!!

Yeah, I need to write the Help docs to make it more obvious. I need to rethink the redness too. Maybe a little text blob on hover (Like the sidemenu) that states a broken link.

 

And yeah, the MP3s are increasing every day. It's really a quite simple series of cron scripts coded by moi that crawl the web. Not open source i'm afraid :P.

 

Thanks for the crits though. Have you found any security issues?

Full Path Disclosure:

http://beta.imuzic.co.uk/download.php?id[]

Warning: mysql_real_escape_string() expects parameter 1 to be string, array given in E:\iwebsites\imuzic\sd_beta\download.php on line 7

 

Warning: setcookie() expects parameter 2 to be string, array given in E:\iwebsites\imuzic\sd_beta\download.php on line 8

 

Warning: mysql_real_escape_string() expects parameter 1 to be string, array given in E:\iwebsites\imuzic\sd_beta\download.php on line 11

 

Warning: Cannot modify header information - headers already sent by (output started at E:\iwebsites\imuzic\sd_beta\download.php:7) in E:\iwebsites\imuzic\sd_beta\download.php on line 15

 

Full Path Disclosure:

http://beta.imuzic.co.uk/files/search.php?q[]

Warning: urldecode() expects parameter 1 to be string, array given in E:\iwebsites\imuzic\sd_beta\files\search.php on line 7

 

Warning: setcookie() expects parameter 2 to be string, array given in E:\iwebsites\imuzic\sd_beta\files\search.php on line 10

 

Full Path Disclosure:

http://beta.imuzic.co.uk/static/search/test&page=0

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in E:\iwebsites\imuzic\sd_beta\static\search.php on line 78

 

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in E:\iwebsites\imuzic\sd_beta\static\search.php on line 80

 

Full Path Disclosure:

http://beta.imuzic.co.uk/static/search/test&page[]

Warning: setcookie() expects parameter 2 to be string, array given in E:\iwebsites\imuzic\sd_beta\static\search.php on line 9

 

Warning: Cannot modify header information - headers already sent by (output started at E:\iwebsites\imuzic\sd_beta\static\search.php:9) in E:\iwebsites\imuzic\sd_beta\static\search.php on line 14

 

Fatal error: Unsupported operand types in E:\iwebsites\imuzic\sd_beta\static\search.php on line 75

 

Full Path Disclosure:

http://beta.imuzic.co.uk/files/more.php?id[]

Warning: mysql_real_escape_string() expects parameter 1 to be string, array given in E:\iwebsites\imuzic\sd_beta\files\more.php on line 16

Attack Details:

 

    * HTTP Method:HEAD

 

Got access to a resource that should be protected. Server response code: 200 OK.

 

Fix: disallow HEAD method in Htacess file.

RewriteCond %{REQUEST_METHOD} !^(GET|HEAD|OPTIONS|POST|PUT)
RewriteRule .* - [F]

Full Path Disclosure:

http://beta.imuzic.co.uk/download.php?id[]

Warning: mysql_real_escape_string() expects parameter 1 to be string, array given in E:\iwebsites\imuzic\sd_beta\download.php on line 7

 

Warning: setcookie() expects parameter 2 to be string, array given in E:\iwebsites\imuzic\sd_beta\download.php on line 8

 

Warning: mysql_real_escape_string() expects parameter 1 to be string, array given in E:\iwebsites\imuzic\sd_beta\download.php on line 11

 

Warning: Cannot modify header information - headers already sent by (output started at E:\iwebsites\imuzic\sd_beta\download.php:7) in E:\iwebsites\imuzic\sd_beta\download.php on line 15

 

Full Path Disclosure:

http://beta.imuzic.co.uk/files/search.php?q[]

Warning: urldecode() expects parameter 1 to be string, array given in E:\iwebsites\imuzic\sd_beta\files\search.php on line 7

 

Warning: setcookie() expects parameter 2 to be string, array given in E:\iwebsites\imuzic\sd_beta\files\search.php on line 10

 

Full Path Disclosure:

http://beta.imuzic.co.uk/static/search/test&page=0

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in E:\iwebsites\imuzic\sd_beta\static\search.php on line 78

 

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in E:\iwebsites\imuzic\sd_beta\static\search.php on line 80

 

Full Path Disclosure:

http://beta.imuzic.co.uk/static/search/test&page[]

Warning: setcookie() expects parameter 2 to be string, array given in E:\iwebsites\imuzic\sd_beta\static\search.php on line 9

 

Warning: Cannot modify header information - headers already sent by (output started at E:\iwebsites\imuzic\sd_beta\static\search.php:9) in E:\iwebsites\imuzic\sd_beta\static\search.php on line 14

 

Fatal error: Unsupported operand types in E:\iwebsites\imuzic\sd_beta\static\search.php on line 75

 

Full Path Disclosure:

http://beta.imuzic.co.uk/files/more.php?id[]

Warning: mysql_real_escape_string() expects parameter 1 to be string, array given in E:\iwebsites\imuzic\sd_beta\files\more.php on line 16

 

Thanks, but how do I fix these? Something like (int) $_GET['id'] or (string) $_GET['q']?

I just do this for all of them.

 

$variable = mysql_real_escape_string($_GET['varname']);

 

How would I go about protecting that from what was suggested above? I did the HEAD fix by the way. Mind testing that out again for me?

 

Never mind. I fixed all those Full Path Disclosures. Anything else vulnerable?

  • 3 weeks later...
  • 1 month later...
  • 2 weeks later...
×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.