Quote from: DevSoft on May 12, 2016, 01:59:29 PM

Found this web-site, and I could see security holes in the first minute browsing it.I have just made a full vulnerability test on your web-site - https://winbtc.onlineYours is in a pretty bad shape at the moment.Let me show you what I have found:SQL Injection"NOTE! Security issue like this can allow an attacker to gain access to your MySQL Database, and access private information."Vulnerable input field: "Enter Your BTC Address Here"The Field: http://puu.sh/oP9xK/96a40e6f5c.pngIf you enter this: btcadd=1'%22&r=&yn=submit in this field, you will get a MySQL Error:The Error:http://puu.sh/oP9GA/590c373340.png

Code:

Warning: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in /home/lng6ojtci/public_html/winbtc.online/index.php on line 185Warning: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in /home/lng6ojtci/public_html/winbtc.online/index.php on line 199

Want to test your-self?Enter: btcadd=1'%22&r=&yn=submit into the "Enter Your BTC Address Here" field.

There are 1 more input field, which is Vulnerable to this same Security hole.Vulnerable input field: "Enter Your BTC Address Here"Location: https://winbtc.online/lookup.phpThe Field: http://puu.sh/oPaff/7cada1149a.pngWant to test your-self?If you enter this: btcadd=1'%22&r=&yn=submit in this field, you will get a MySQL Error:The Error:http://puu.sh/oPah8/24b574561b.png

Code:

Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in /home/lng6ojtci/public_html/winbtc.online/getuser.php on line 170

Another Big Programming "Carelesness"System takes queries from Database using this file: "https://winbtc.online/getuser.php".NOW, you can just enter what ever "Depositer ID" you like, and you have access to Investor Info. However Database looks primitive.Want to test your-self?Add this to the link I gave you above - "?=1", and you will see the database records.Like this: https://winbtc.online/getuser.php?q=1And you will see:http://puu.sh/oPdfG/420cf0a76d.pngThis happens because the digit in the link is actually an ID from the Database, which lets you select which ever database record you want.You can play around just by changing the digit.Example:https://winbtc.online/getuser.php?q=5

Cross-Site Scripting"Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them."I found this on multiple pages, however I will show you 1 example, otherwise the report will be too long.One of the pages affected by this is: https://winbtc.online/faq.phpYou can simply change this link to (example): https://winbtc.online/faq.php/%22onmouseover='prompt%28940945%29'bad=%22%3EAnd now when you mouse-over everywhere on the page, the injected JS will activate. In this case, when you mouse-over anything, you will get a simple JavaScript Popup Message, to prove the concept is real and working.Preview:http://puu.sh/oPbF1/cc547a35a3.png

Sorry for the long report,Thank you,Devsoft.

Thank you for the report, I will contact you about setting up my BTC Project.

Bucc

Posts

Merits