ahzulfi Posted February 2, 2008 Share Posted February 2, 2008 Hello, i have tried my best to remove all kind of vulnerabilities, please retest my script, http://livedemo.clip-bucket.com/ also Comment on it Thanx And Regards ArslanHassan Link to comment Share on other sites More sharing options...
agentsteal Posted February 2, 2008 Share Posted February 2, 2008 Array: http://livedemo.clip-bucket.com/search_result.php?query[] Full Path Disclosure: http://livedemo.clip-bucket.com/includes/classes/TFile.php Parse error: syntax error, unexpected ':' in /home/clipbuck/public_html/livedemo/includes/classes/TFile.php on line 11 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/playerconfig/config.xml.php Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /home/clipbuck/public_html/livedemo/includes/playerconfig/config.xml.php:13) in /home/clipbuck/public_html/livedemo/includes/config.inc.php on line 18 Warning: include(template_changer.php) [function.include]: failed to open stream: No such file or directory in /home/clipbuck/public_html/livedemo/includes/config.inc.php on line 164 Warning: include() [function.include]: Failed opening 'template_changer.php' for inclusion (include_path='.:/usr/local/php5/lib/php') in /home/clipbuck/public_html/livedemo/includes/config.inc.php on line 164 /home/clipbuck/public_html/livedemo/videos/ http://livedemo.clip-bucket.com/includes/playerconfig/videolist.xml.php Full Path Disclosure: http://livedemo.clip-bucket.com/includes/modules.php Warning: mysql_query() [function.mysql-query]: Access denied for user 'clipbuck'@'localhost' (using password: NO) in /home/clipbuck/public_html/livedemo/includes/modules.php on line 104 Warning: mysql_query() [function.mysql-query]: A link to the server could not be established in /home/clipbuck/public_html/livedemo/includes/modules.php on line 104 Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home/clipbuck/public_html/livedemo/includes/modules.php on line 105 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/defined_links.php Fatal error: Call to undefined function Assign() in /home/clipbuck/public_html/livedemo/includes/defined_links.php on line 49 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/active.php Fatal error: Call to undefined function Assign() in /home/clipbuck/public_html/livedemo/includes/active.php on line 45 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/adodb.php Fatal error: Call to undefined method stdClass::Connect() in /home/clipbuck/public_html/livedemo/includes/adodb/adodb.php on line 5 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/contrib/toxmlrpc.inc.php Warning: require_once(xmlrpc.inc) [function.require-once]: failed to open stream: No such file or directory in /home/clipbuck/public_html/livedemo/includes/adodb/contrib/toxmlrpc.inc.php on line 20 Fatal error: require_once() [function.require]: Failed opening required 'xmlrpc.inc' (include_path='.:/usr/local/php5/lib/php') in /home/clipbuck/public_html/livedemo/includes/adodb/contrib/toxmlrpc.inc.php on line 20 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/datadict/datadict-firebird.inc.php Fatal error: Class 'ADODB_DataDict' not found in /home/clipbuck/public_html/livedemo/includes/adodb/datadict/datadict-firebird.inc.php on line 13 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/drivers/adodb-pdo_mssql.inc.php Fatal error: Class 'ADODB_pdo' not found in /home/clipbuck/public_html/livedemo/includes/adodb/drivers/adodb-pdo_mssql.inc.php on line 13 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/drivers/adodb-pdo_mysql.inc.php Fatal error: Class 'ADODB_pdo' not found in /home/clipbuck/public_html/livedemo/includes/adodb/drivers/adodb-pdo_mysql.inc.php on line 13 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/drivers/adodb-pdo_mysql.inc.php Fatal error: Class 'ADODB_pdo' not found in /home/clipbuck/public_html/livedemo/includes/adodb/drivers/adodb-pdo_mysql.inc.php on line 13 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/drivers/adodb-pdo_oci.inc.php Fatal error: Class 'ADODB_pdo_base' not found in /home/clipbuck/public_html/livedemo/includes/adodb/drivers/adodb-pdo_oci.inc.php on line 13 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/drivers/adodb-pdo_pgsql.inc.php Fatal error: Class 'ADODB_pdo' not found in /home/clipbuck/public_html/livedemo/includes/adodb/drivers/adodb-pdo_pgsql.inc.php on line 12 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/drivers/adodb-sybase_ase.inc.php Warning: require_once(ADODB_DIR/drivers/adodb-sybase.inc.php) [function.require-once]: failed to open stream: No such file or directory in /home/clipbuck/public_html/livedemo/includes/adodb/drivers/adodb-sybase_ase.inc.php on line 14 Fatal error: require_once() [function.require]: Failed opening required 'ADODB_DIR/drivers/adodb-sybase.inc.php' (include_path='.:/usr/local/php5/lib/php') in /home/clipbuck/public_html/livedemo/includes/adodb/drivers/adodb-sybase_ase.inc.php on line 14 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/pear/Auth/Container/ADOdb.php Warning: require_once(Auth/Container.php) [function.require-once]: failed to open stream: No such file or directory in /home/clipbuck/public_html/livedemo/includes/adodb/pear/Auth/Container/ADOdb.php on line 23 Fatal error: require_once() [function.require]: Failed opening required 'Auth/Container.php' (include_path='.:/usr/local/php5/lib/php') in /home/clipbuck/public_html/livedemo/includes/adodb/pear/Auth/Container/ADOdb.php on line 23 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/session/adodb-compress-bzip2.php Fatal error: bzip2 functions are not available in /home/clipbuck/public_html/livedemo/includes/adodb/session/adodb-compress-bzip2.php on line 14 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/session/adodb-encrypt-secret.php Fatal error: Directory not found: '/home/clipbuck/public_html/livedemo/includes/horde' in /home/clipbuck/public_html/livedemo/includes/adodb/session/adodb-encrypt-secret.php on line 16 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/session/old/adodb-cryptsession.php Warning: include(/home/clipbuck/public_html/livedemo/includes/adodb/session/old/adodb.inc.php) [function.include]: failed to open stream: No such file or directory in /home/clipbuck/public_html/livedemo/includes/adodb/session/old/adodb-cryptsession.php on line 64 Warning: include() [function.include]: Failed opening '/home/clipbuck/public_html/livedemo/includes/adodb/session/old/adodb.inc.php' for inclusion (include_path='.:/usr/local/php5/lib/php') in /home/clipbuck/public_html/livedemo/includes/adodb/session/old/adodb-cryptsession.php on line 64 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/session/old/adodb-session-clob.php Warning: include(/home/clipbuck/public_html/livedemo/includes/adodb/session/old/adodb.inc.php) [function.include]: failed to open stream: No such file or directory in /home/clipbuck/public_html/livedemo/includes/adodb/session/old/adodb-session-clob.php on line 90 Warning: include() [function.include]: Failed opening '/home/clipbuck/public_html/livedemo/includes/adodb/session/old/adodb.inc.php' for inclusion (include_path='.:/usr/local/php5/lib/php') in /home/clipbuck/public_html/livedemo/includes/adodb/session/old/adodb-session-clob.php on line 90 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/session/old/adodb-session.php Warning: include(/home/clipbuck/public_html/livedemo/includes/adodb/session/old/adodb.inc.php) [function.include]: failed to open stream: No such file or directory in /home/clipbuck/public_html/livedemo/includes/adodb/session/old/adodb-session.php on line 100 Warning: include() [function.include]: Failed opening '/home/clipbuck/public_html/livedemo/includes/adodb/session/old/adodb.inc.php' for inclusion (include_path='.:/usr/local/php5/lib/php') in /home/clipbuck/public_html/livedemo/includes/adodb/session/old/adodb-session.php on line 100 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/tests/benchmark.php Fatal error: Class 'VARIANT' not found in /home/clipbuck/public_html/livedemo/includes/adodb/drivers/adodb-ado5.inc.php on line 42 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/tests/test-active-record.php Warning: mysql_connect() [function.mysql-connect]: Access denied for user 'root'@'localhost' (using password: NO) in /home/clipbuck/public_html/livedemo/includes/adodb/drivers/adodb-mysql.inc.php on line 365 Fatal error: Call to undefined method stdClass::Execute() in /home/clipbuck/public_html/livedemo/includes/adodb/tests/test-active-record.php on line 18 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/tests/test-active-recs2.php Notice: Use of undefined constant OCI_COMMIT_ON_SUCCESS - assumed 'OCI_COMMIT_ON_SUCCESS' in /home/clipbuck/public_html/livedemo/includes/adodb/adodb.inc.php on line 4084 Fatal error: Call to a member function ServerInfo() on a non-object in /home/clipbuck/public_html/livedemo/includes/adodb/tests/test-active-recs2.php on line 21 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/tests/test-datadict.php Notice: Use of undefined constant ODBC_BINMODE_RETURN - assumed 'ODBC_BINMODE_RETURN' in /home/clipbuck/public_html/livedemo/includes/adodb/adodb.inc.php on line 4084 Notice: Use of undefined constant SQL_CUR_USE_DRIVER - assumed 'SQL_CUR_USE_DRIVER' in /home/clipbuck/public_html/livedemo/includes/adodb/adodb.inc.php on line 4084 Notice: Use of undefined constant ODBC_BINMODE_RETURN - assumed 'ODBC_BINMODE_RETURN' in /home/clipbuck/public_html/livedemo/includes/adodb/adodb.inc.php on line 4084 Notice: Use of undefined constant SQL_CUR_USE_DRIVER - assumed 'SQL_CUR_USE_DRIVER' in /home/clipbuck/public_html/livedemo/includes/adodb/adodb.inc.php on line 4084 Notice: Use of undefined constant OCI_COMMIT_ON_SUCCESS - assumed 'OCI_COMMIT_ON_SUCCESS' in /home/clipbuck/public_html/livedemo/includes/adodb/adodb.inc.php on line 4084 Fatal error: Call to undefined function pg_escape_string() in /home/clipbuck/public_html/livedemo/includes/adodb/drivers/adodb-postgres64.inc.php on line 241 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/tests/test-php5.php Warning: mysql_connect() [function.mysql-connect]: Access denied for user 'root'@'localhost' (using password: NO) in /home/clipbuck/public_html/livedemo/includes/adodb/drivers/adodb-mysql.inc.php on line 365 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/tests/test-xmlschema.php Warning: mysql_connect() [function.mysql-connect]: Access denied for user 'root'@'localhost' (using password: NO) in /home/clipbuck/public_html/livedemo/includes/adodb/drivers/adodb-mysql.inc.php on line 365 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/tests/test.php Warning: mysql_pconnect() [function.mysql-pconnect]: Access denied for user 'root'@'localhost' (using password: NO) in /home/clipbuck/public_html/livedemo/includes/adodb/drivers/adodb-mysql.inc.php on line 383 Notice: Trying to get property of non-object in /home/clipbuck/public_html/livedemo/includes/adodb/tests/testdatabases.inc.php on line 244 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/tests/test2.php Fatal error: Class 'VARIANT' not found in /home/clipbuck/public_html/livedemo/includes/adodb/drivers/adodb-ado5.inc.php on line 42 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/tests/test3.php Notice: Use of undefined constant OCI_COMMIT_ON_SUCCESS - assumed 'OCI_COMMIT_ON_SUCCESS' in /home/clipbuck/public_html/livedemo/includes/adodb/adodb.inc.php on line 4084 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/tests/test4.php Warning: mysql_pconnect() [function.mysql-pconnect]: Access denied for user 'root'@'localhost' (using password: NO) in /home/clipbuck/public_html/livedemo/includes/adodb/drivers/adodb-mysql.inc.php on line 383 Fatal error: Call to a member function prepare() on a non-object in /home/clipbuck/public_html/livedemo/includes/adodb/drivers/adodb-pdo.inc.php on line 341 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/tests/testcache.php Warning: mysql_pconnect() [function.mysql-pconnect]: Unknown MySQL server host 'mangrove' (4) in /home/clipbuck/public_html/livedemo/includes/adodb/drivers/adodb-mysql.inc.php on line 383 Fatal error: Call to a member function GetArray() on a non-object in /home/clipbuck/public_html/livedemo/includes/adodb/tests/testcache.php on line 27 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/tests/testdatabases.inc.php Fatal error: Call to undefined function ADOLoadCode() in /home/clipbuck/public_html/livedemo/includes/adodb/tests/testdatabases.inc.php on line 295 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/tests/testoci8.php Notice: Use of undefined constant OCI_COMMIT_ON_SUCCESS - assumed 'OCI_COMMIT_ON_SUCCESS' in /home/clipbuck/public_html/livedemo/includes/adodb/adodb.inc.php on line 4084 Fatal error: Call to undefined function OCIParse() in /home/clipbuck/public_html/livedemo/includes/adodb/drivers/adodb-oci8.inc.php on line 1001 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/tests/testoci8cursor.php Notice: Use of undefined constant OCI_COMMIT_ON_SUCCESS - assumed 'OCI_COMMIT_ON_SUCCESS' in /home/clipbuck/public_html/livedemo/includes/adodb/adodb.inc.php on line 4084 Fatal error: Call to undefined function OCIParse() in /home/clipbuck/public_html/livedemo/includes/adodb/drivers/adodb-oci8.inc.php on line 790 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/tests/testpaging.php Notice: Use of undefined constant OCI_COMMIT_ON_SUCCESS - assumed 'OCI_COMMIT_ON_SUCCESS' in /home/clipbuck/public_html/livedemo/includes/adodb/adodb.inc.php on line 4084 /tmp/8e/adodb_8e73344b801e58ea7543f1ce3a7a6e58.cache cache failure: /tmp/8e/adodb_8e73344b801e58ea7543f1ce3a7a6e58.cache file/URL not found (see sql below) Fatal error: Call to undefined function OCIParse() in /home/clipbuck/public_html/livedemo/includes/adodb/drivers/adodb-oci8.inc.php on line 1001 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/adodb/tests/testpear.php Warning: mysql_connect() [function.mysql-connect]: Access denied for user 'root'@'localhost' (using password: NO) in /home/clipbuck/public_html/livedemo/includes/adodb/drivers/adodb-mysql.inc.php on line 365 Fatal error: Call to undefined method PEAR_Error::setFetchMode() in /home/clipbuck/public_html/livedemo/includes/adodb/tests/testpear.php on line 24 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/templatelib/Template_Compiler.class.php Fatal error: Class 'Smarty' not found in /home/clipbuck/public_html/livedemo/includes/templatelib/Template_Compiler.class.php on line 35 Full Path Disclosure: http://livedemo.clip-bucket.com/includes/templatelib/plugins/modifier.date_format.php Fatal error: Call to a member function _get_plugin_filepath() on a non-object in /home/clipbuck/public_html/livedemo/includes/templatelib/plugins/modifier.date_format.php on line 11 Insecure Cookie: You shouldn't put the username in the cookie. SQL Dump: http://livedemo.clip-bucket.com/includes/adodb/session/adodb-sessions.mysql.sql SQL Dump: http://livedemo.clip-bucket.com/includes/adodb/session/adodb-sessions.oracle.clob.sql SQL Dump: http://livedemo.clip-bucket.com/includes/adodb/session/adodb-sessions.oracle.sql SQL Dump: http://livedemo.clip-bucket.com/includes/adodb/tests/test-datadict.php User Enumeration: http://livedemo.clip-bucket.com/~clipbuck User Enumeration: http://livedemo.clip-bucket.com/~nobody User Enumeration: http://livedemo.clip-bucket.com/~root Link to comment Share on other sites More sharing options...
ahzulfi Posted February 3, 2008 Author Share Posted February 3, 2008 Hello, i have removed every path disclosure and sql dumb etc.... please retest it for the last time..... thanx Arslan Hassan Link to comment Share on other sites More sharing options...
Coreye Posted February 3, 2008 Share Posted February 3, 2008 Full Ptah Disclosure: Parse error: syntax error, unexpected ':' in /home/clipbuck/public_html/livedemo/includes/classes/TFile.php on line 11 http://livedemo.clip-bucket.com/includes/classes/TFile.php Link to comment Share on other sites More sharing options...
ahzulfi Posted February 4, 2008 Author Share Posted February 4, 2008 please tell me how to Shoot this problem ??? Link to comment Share on other sites More sharing options...
ahzulfi Posted February 4, 2008 Author Share Posted February 4, 2008 shooted please test it........again Link to comment Share on other sites More sharing options...
phpSensei Posted February 7, 2008 Share Posted February 7, 2008 Just Want to say I love this idea, and you must have put alot of time into it... good job. Link to comment Share on other sites More sharing options...
Recommended Posts