Illumina CMS [PHP, OOP, MySQLi, Uber 3]

[GotMilk]

What is the db?

[GotMilk]

Uses the SMARTY template system and is fully MySQLi!! I also made the news articles use BBcode instead of HTML incase of malicious person trying to do <meta http-equiv="redirect" to send users to another hotel...

Screenshot by Lightshot (bbcode is sent auto by the hk editor btw, no need for staff to remember it all)

Bans (done this morning actually lol)
User Ban: Screenshot by Lightshot
IP Ban: Screenshot by Lightshot
Ban appealed.. Screenshot by Lightshot - Screenshot by Lightshot
appeal responded to!!! Screenshot by Lightshot

Whoever checks the ban now can decide to leave a message for the user, explaining the rejection maybe. If they don't want to respond, a generic response is left! Screenshot by Lightshot

Goodjob with this Heju! When will it be released? anytime this week? Also can swift emu be used for it?

[Gin0]

Wrong. Hundreds of XSS based attacks can be carried out… still.

If you actually had any knowledge on exploits, you'd know that you can't gain access to a database carrying out XSS vulnerabilities. They're quite useless and the most they can do is edit a few things on your CMS.

[Delici0us]

If you actually had any knowledge on exploits, you'd know that you can't gain access to a database carrying out XSS vulnerabilities. They're quite useless and the most they can do is edit a few things on your CMS.

Are you a retard? Who cares about the database!? As soon as you hijack a staff member’s session you have access to the housekeeping, I’ve used it hundreds of times on this very CMS. So pipe down you fool.

It’s obviously you who has zero understanding of exploits. “They're quite useless and the most they can do is edit a few things on your CMS.” – Hmm. So that’s why PayPal & Facebook consider them high risk exploits and actually pay people to report them? Because as you said all you can do is ‘edit a few things’ you complete idiot.

[eckostylez]

If you actually had any knowledge on exploits, you'd know that you can't gain access to a database carrying out XSS vulnerabilities. They're quite useless and the most they can do is edit a few things on your CMS.

You're an idiot.

Using RFI, you could easily dump the contents of an entire database. Please know wtf you are talking about before spewing ignorant statements.

[oltem4682]

Well this look interesting, I will give it a try :)