News & Sales site

[siwelis]

Up until I started this website, all I used PHP for was the useful "include." I thought it was amazing at the time. Now, after doing the new version of my site (making it so I don't have to spend over an hour to add news story), I've learned I've still just scratched the surface of PHP (SQL too).

 

If you can let me know what you think of my new site... http://www.chexed.com/intest.php I'd really appreciate it! Also, please let me know if you find any security holes as well... Thank you!

[siwelis]

Holy Crap, it looks like the DNS servers updated in less than 20 minutes... Usually it takes like 2 days, I didn't want it to happen this fast, for once! lol...

 

http://chexed.com/

 

In case it hasn't propagated for you yet, it should look like the image I attached to this post...

 

Special thanks to this post for the screen shot: http://www.phpfreaks.com/forums/index.php/topic,127228.0.html

 

[attachment deleted by admin]

[agentsteal]

Cross Site Scripting:

http://www.chexed.com/cart.php/"><marquee><h1>vulnerable</marquee>

 

Cross Site Scripting:

http://www.chexed.com/cgi-sys/scgiwrap/<marquee><h1>vulnerable</marquee>

 

Cross Site Scripting:

http://www.chexed.com/products.php/"><marquee><h1>vulnerable</marquee>

 

Full Path Disclosure:

http://www.chexed.com/cgi-sys/scgiwrap/

 

User Enumeration:

http://www.chexed.com/~root

[siwelis]

You should block this file. It has Full Path Disclosure and Cross Site Scripting.

http://www.chexed.com/cgi-sys/scgiwrap

 

I can't even find this file... I've tried using mod rewrite on it and it doesn't seem to do anything with it. Anyone know how to find or block access to this file?