TechnoSlab

Features:

1. Uses PHP cURL for grabbing.
2. Stores links in XML files.
3. Dynamic page caching mechanism to reduce server overhead.
4. Changes tags automatically or removes them ( including album art).
5. Renames mp3 files to include your website's name.
6. Shows latest updates on main page.

Email me at for demo and download link ( free or paid depending on who you are)!

Selling 10 copies, Sold 2 yet.

A very simple program that generates random but secure passwords for you. Place it anywhere on desktop and use it to generate passwords when registering on sites. ;)

Features:
1. Generate random passwords
2. Generate even more random passwords?
3. Copy/Vary password length

Download: http://www.4shared.com/file/S2iyxaj0/randompw.html

This is a good script for grabbers and other websites where dynamic page creation causes too much overhead. The script will cache the page and store it in a database for a specific time period ( defined as lifespan i.e. last parameter of the constructor).
The cached page will be directly sent to browser and script's execution will be terminated. If no cached page is found or a new page is requested, then the script will execute as normal but will cache the page and stored it for future.
Read through comments in the top section of script for instructions related to installation and usage.  

Chipmunk forum script is still used by a few webmasters (including me) so I'm posting this new security vulnerability here and I request all the owners to patch it ASAP.

The problem lies with a SQL query which updates user's current location on forum.

Query:

UPDATE <prefix>_users SET userwhere = '$_SESSION[user] is viewing thread: $threadTitle' where username = '$_SESSION[user]'

The variable $threadTitle is actually sanitized before storing it in posts table but when it is retrieved, it regains it's original form. Now this retrieved form is used inside query without escaping which can be easily exploited.

Say original thread title was "Happy new year", the stored one would be "Happy new year" and the retrieved one would be "Happy new year".

Now suppose a notorious user has arrived and he tries follow thread title "',status='9',userwhere=userwhere--", then the stored thread title is "Hacked\',status=\'9\',userwhere=userwhere--". This is okay but when it is retrived, it regains it's original form i.e. "Hacked',status='9',userwhere=userwhere--". When this title is used in the query,
the resulting query becomes




After re-arranging :
When this query is executed, all users are upgraded to a status 9 which is owner's status in Chipmunk forum. Similarly user can craft another set of query to do something else. The hacker can also extend this to inject something inside posts or forum.

How to fix it ?

It's easy! Follow the golden rule : Always sanitize a variable before placing it in a query.



Then proceed with the query

PS: I have not properly explain how to hack for I don't want anymore to hack anything after reading this blog post.

Don't copy my findings and tutorials.
Don't hack someone's forum based on this knowledge.
Contact me if you've issues implementing the fix.  Good luck and Enjoy!

Here's a quick tutorial on how to upgrade you XAMPP installation to use latest version of PHP that is PHP version 5.4.

1. Download windows build from the official site. ( I had used this link.)

2. Extract all files from the downloaded archive to a temporary folder say php_new.

3. Make sure XAMPP / Apache is not running.

3. Go to the folder where XAMPP is installed and rename the folder XAMPP_ROOT/php to php_old

4. Now go back to our temporary folder i.e. php_new and copy all files to XAMPP_ROOT/php where XAMPP_ROOT is obviously the folder where XAMPP has been installed.

5. Enter the php folder and locate the file(s) php5apache*.dll ( Example php5apache2_2.dll )



6. Copy those files to XAMPP_ROOT/apache/modules/ depending on your version of Apache

7. Optionally delete the folders php_new and php_old

8. Start Apache again and verify that everything is working smoothly by creating a phpinfo file.


9. Don't forget to rename php.ini-production to php.ini and edit it as per your needs. ( Example: set extension_dir to XAMPP_ROOT/php/ext

10. Check Apache logs for any possible errors.