zfred09 Posted August 22, 2007 Share Posted August 22, 2007 Hello everyone, This is a project of mine that I have been working on the past couple months, basically it is a user generated content site, where users find articles/news/lyrics and submit them. The website will then convert this submission and make it viewable on your Zune or Ipod. We are currently just starting beta and would appreciate feedback and/or your help in spreading the word about the site. Thanks. www.zidub.com Link to comment Share on other sites More sharing options...
source Posted August 23, 2007 Share Posted August 23, 2007 http://www.zidub.com/searchinfo.php xssable http://www.zidub.com/register.php xssable by say, entering "><marquee>ownd as a username and just hitting enter. dont have much time tonite tho, i;ll look at it later. Link to comment Share on other sites More sharing options...
agentsteal Posted August 23, 2007 Share Posted August 23, 2007 Cross Site Scripting: http://www.zidub.com/cgi-sys/scgiwrap/<marquee><h1>vulnerable</marquee> Cross Site Scripting: There is Cross Site Scripting if you submit a search that contains code. Cross Site Scripting: There is Cross Site Scripting if you submit code in the drop down menu on the articles page. Cross Site Scripting: There is Cross Site Scripting when you register if the fields contain code. Drop Down Menu: If you edit the drop down menu on the articles page you can submit arbitrary values. Full Path Disclosure: http://www.zidub.com/cgi-sys/scgiwrap/ User Enumeration: http://www.zidub.com/~root User Enumeration: http://www.zidub.com/~zfred09 Link to comment Share on other sites More sharing options...
zfred09 Posted August 23, 2007 Author Share Posted August 23, 2007 Thank You for your finds, I pry won't get around to fixing them until this weekend. Also about the zidub.com/cgi-sys/scgiwrap url, I contacted my host about this a while ago and they said they couldn't do anything about it. They don't even have it blocked on their webpage. How would I go about blocking this? Link to comment Share on other sites More sharing options...
source Posted August 23, 2007 Share Posted August 23, 2007 change the permissions on the directory. or add a password to it. Link to comment Share on other sites More sharing options...
zfred09 Posted August 23, 2007 Author Share Posted August 23, 2007 Yes I could do that except the directory doesn't show up anywhere, at least that I can find. Link to comment Share on other sites More sharing options...
zfred09 Posted September 6, 2007 Author Share Posted September 6, 2007 Hello once again, I think I fixed most of the above problems (Please check), except I still cannot block the cgi-sys url. Any idea how to do this as the folder does not show up in my ftp? Thankyou all for your help so far. Link to comment Share on other sites More sharing options...
zfred09 Posted September 10, 2007 Author Share Posted September 10, 2007 Anyone? Link to comment Share on other sites More sharing options...
zfred09 Posted September 21, 2007 Author Share Posted September 21, 2007 How do you fix this? Link to comment Share on other sites More sharing options...
Recommended Posts