lavalair script holes

[Vayne]

pff.. is there anything to keep in secret??

some pages doesn't have

mysql_escape_string

most of them was in older lavalair scripts, main page's.

if u get number from database, like uid, than query make in intval();
etc..
type in adress log-

g sql injection

[something else]

People wont share the holes as it will make a mad frenzy on hacking!
The 2 main injection holes have been wrote in this forum already.
and the solutions are in here aswell.

[anderson]

i know how to block c99shell from being used in any upload folder

ozzie plz share ur experience on it sothat we can know more.

[ozziemale31]

i know how to block c99shell from being used in any upload folder

[tres]

what are the other posible holes? and what are the solution?

[tres]

yah. So i have activated my hotlink protection..

[anderson]

yeah! Session id hijacking only steal ses id... but c99shell can control ur cpanel. mass inject, delete file, upload file etc.

use a secured uploader.

[ranzit2]

yeah! Session id hijacking only steal ses id... but c99shell can control ur cpanel. mass inject, delete file, upload file etc.

c99 shell need to b uploaded but image need only to b linked.may b u had nt gud uploader

[tres]

yeah! Session id hijacking only steal ses id... but c99shell can control ur cpanel. mass inject, delete file, upload file etc.

[ozziemale31]

c99shell is crap i can steal a session using a php image done it to scot paul many a times lol

[ozziemale31]

well you've come to the rite place to learn lol

[tres]

some intruderz uses c99shell. a famous hacking tool.... i am a victim of that c99shell.... A few months ago.. They have chmoded my file and folders to 0000..

[tres]

hackers never reveals it self! we are here to share knowledge and to help others.. we use lavalair for our site becouse we dont have such knowledge to code...

[ozziemale31]

lol i know most ways of hacking this script but a good hacker never tells ther secrets

[kei_ki7]

This type of topic has been created here many times. So no need to create newly.

i think he need the link ??