Video & Music Hosting

[mattd8752]

This project is only partly developed, but I would like some suggestions and comments please.  Also, if anyone finds any bugs please tell me.

 

Right now you can't use search or upload files.  Just look at what is there and tell me if you see any potential security issues.

 

http://www.mattdsworld.com/vid/

[agentsteal]

Full Path Disclosure:

http://www.mattdsworld.com/wp/wp-admin/admin-footer.php

 

Full Path Disclosure:

http://www.mattdsworld.com/wp/wp-admin/admin-functions.php

 

Full Path Disclosure:

http://www.mattdsworld.com/wp/wp-admin/edit-form-advanced.php

 

Full Path Disclosure:

http://www.mattdsworld.com/wp/wp-admin/edit-form-comment.php

 

Full Path Disclosure:

http://www.mattdsworld.com/wp/wp-admin/edit-form.php

 

Full Path Disclosure:

http://www.mattdsworld.com/wp/wp-admin/edit-link-form.php

 

Full Path Disclosure:

http://www.mattdsworld.com/wp/wp-admin/edit-page-form.php

 

Full Path Disclosure:

http://www.mattdsworld.com/wp/wp-admin/menu-header.php

 

Full Path Disclosure:

http://www.mattdsworld.com/wp/wp-admin/menu.php

 

Full Path Disclosure:

http://www.mattdsworld.com/wp/wp-includes/default-filters.php

 

Full Path Disclosure:

http://www.mattdsworld.com/wp/wp-includes/kses.php

 

Full Path Disclosure:

http://www.mattdsworld.com/wp/wp-includes/locale.php

 

Full Path Disclosure:

http://www.mattdsworld.com/wp/wp-includes/rss-functions.php

 

Full Path Disclosure:

http://www.mattdsworld.com/wp/wp-includes/template-loader.php

 

Full Path Disclosure:

http://www.mattdsworld.com/wp/wp-includes/vars.php

 

Full Path Disclosure:

http://www.mattdsworld.com/wp/wp-includes/wp-db.php

 

Full Path Disclosure:

http://www.mattdsworld.com/wp/wp-settings.php

 

User Enumeration:

http://www.mattdsworld.com/~root

[mattd8752]

Thats the word press.  What can I do to protect that?

[Lumio]

or error_reporting(0); in the beginning of every file.

[mattd8752]

Thanks, any other problems.  Or suggestions for the vid site?

[mattd8752]

Well, there isn't much I can do for path disclosure.

 

My host is dumb enough to setup permission to say you don't have permission to access "path here"...