administer
Compromised account. Please contact Support.
- Nov 19, 2008
- 160
- 26
hello,
looking for a php prog. to add some feats on this script:
http://www.idevspot.com/NixieAffiliate.php
1. exit-logout from admin
2. [ View Affiliates ] add the something so that anytime an affiliate registers he-she gets X$ in the account.
The admin should be able to decide which amount
3. Fix hole:
NixieAffiliate 1.x
http://secunia.com/product/12088/
DESCRIPTION:
s3rv3r_hack3r has reported some vulnerabilities in NixieAffiliate,
which can be exploited by malicious people to bypass certain security
restrictions and conduct cross-site scripting attacks.
1) The delete.php script allows to perform certain actions via HTTP
GET request without checking for valid permissions, which can be
exploited to delete arbitrary affiliates.
2) Input passed to the "error" parameter in forms/lostpassword.php is
not properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.
SOLUTION:
Edit the source code to ensure that permissions are properly verified
and input is properly sanitised.
4. Just a question is it possible to turn in [ Integration Code ] php to javascript
Thank you for your PM with pricing+time
looking for a php prog. to add some feats on this script:
http://www.idevspot.com/NixieAffiliate.php
1. exit-logout from admin
2. [ View Affiliates ] add the something so that anytime an affiliate registers he-she gets X$ in the account.
The admin should be able to decide which amount
3. Fix hole:
NixieAffiliate 1.x
http://secunia.com/product/12088/
DESCRIPTION:
s3rv3r_hack3r has reported some vulnerabilities in NixieAffiliate,
which can be exploited by malicious people to bypass certain security
restrictions and conduct cross-site scripting attacks.
1) The delete.php script allows to perform certain actions via HTTP
GET request without checking for valid permissions, which can be
exploited to delete arbitrary affiliates.
2) Input passed to the "error" parameter in forms/lostpassword.php is
not properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.
SOLUTION:
Edit the source code to ensure that permissions are properly verified
and input is properly sanitised.
4. Just a question is it possible to turn in [ Integration Code ] php to javascript
Thank you for your PM with pricing+time