darkman (2016-05-18 01:04:06)

---

I`m not sure if this has been found before, but I am going to post this anyway.

Today, I was exploring the plaza for hacking vulnerabilities. I found the domain [removed] which shows some data from the plaza.
Anyone can download this page with HTTrack and modify the file content`s and "hack" this website.

And if someone was to inject a backdoor into the domain directory, It can serve as a big threat to this plaza.

Darkman

This post has been edited one or more times, the last time was:
2016-05-18 01:30:55

---

Gumball (2016-05-18 01:11:22)

---

They better fix this soon.

---

Lani (2016-05-18 01:32:29)

---

Thank you for the notice, but for future reference please inform Rob or other moderators privately, as not to invite malicious users to actually try anything bad.

---

darkman (2016-05-18 01:45:01)

---

I informed Rob.

---

NodePoint (2016-05-18 08:32:26)

---

Which sort of files were you able to obtain using the tool? If PHP, does it show any actual PHP code?
(This assumes that is the case. Can't tell with the edits.)

If you want, you could give me the details privately and I can take a look at this. If it turns out to be something valid then it can be put on the list of things to do for Rob.
PM or email should do the trick. Though the latter would be most preferred if possible.

Thanks.

This post has been edited one or more times, the last time was:
2016-05-18 08:44:03

---

darkman (2016-05-18 22:52:38)

---

I think I was the first to find it.

---

NodePoint (2016-05-19 07:39:44)

---

Apparently, it carries no risk and so directory indexing will not be turned off for that directory.
And yes, I agree to him to some extent on this. All it really is doing is listing the files and folders in that directory. Users cannot download the actual scripts.

Of course, if it is linked here then something like a web crawler would pick that up (if it gets to it before removal) and have the links to all of those files and directories on something like Google.
If this were to be private files that might carry risk if someone else accesses them then turning directory indexing in that directory would be the most appropriate action if there is no index file (as configurated in virtual hosts). Obviously, they would need to add checks to that forbidden script but that is something else.

Just in case you users are wondering, the index directory listing pointed out being the issue displays: usual scripts that are accessed everyday, broken scripts (MySQL connection errors, parser fatal error), backups (they are either non-functional or carry no risk when pointing to those in some other way so they could be considered harmless).

Yes, the errors do expose a lot of information (which is the reason why the display_errors directive should be disabled for production) so that can be considered a bad thing. Then if you think about it, it can be fairly easily triggered on parts of the site that are linked to for users (notices, warnings and anything not fatal). Those show the FULL path to the script and gives you a bit of an idea of how the script works.

Count how many other issues are there that have not been fixed regardless of knowledge about them in hopes that no one else discovers them and yet they are a lot worse. There are a few.

I will keep this opened for a bit just in case any of you have input on this.

Before I end this post: this does not mean that it is okay to share the URL. If you figure it out, keep it to yourself. If it is new, do either contact Rob or the most trusted moderator who has contact with him.

This post has been edited one or more times, the last time was:
2016-05-19 07:46:17

---

TheLucarioKid (2016-05-22 20:41:40)

---

^ Crawler bots can't travel user links. They're set to "target='_blank'", which keeps crawler bots off the link.

---

NodePoint (2016-05-22 22:22:25)

---

^ True. Some crawlers may decide to violate this for whatever reason, however. We're not just only talking about search bots.

---

SlenderDude12 (2016-06-12 17:52:22)

---

To be honest, I don't really care if this website gets hacked anyway. It's was already dead in the first place.

---

darkman (2016-06-21 11:41:10)

---

I slightly agree with you Slender.

---

simontv17 (2016-06-26 06:23:54)

---

What about the site being encrypted. You know this entire site does not have HTTPS which means it is more vulnerable to hacking.

---

NodePoint (2016-06-27 09:16:28)

---

Yes, this site does not use TLS (more secure than SSL). Also, it is supposed to encrypt communications between the client and server, not the actual site.

---

simontv17 (2016-07-11 02:04:31)

---

Why don't I see a padlock (https) whenever I use this site.

---

NodePoint (2016-07-12 09:14:55)

---

^ as I said, TLS should be used and not SSL. SSL leaks data with the exploits that are out there.

---