OXIESEC PANEL
- Current Dir:
/
/
var
/
www
/
reader
/
_backup
Server IP: 139.59.38.164
Upload:
Create Dir:
Name
Size
Modified
Perms
📁
..
-
11/28/2024 11:03:35 AM
rwxrwxr-x
📄
COMMITMENT
2.04 KB
02/14/2020 06:07:54 AM
rw-r--r--
📄
Create.php
8.23 KB
08/09/2020 05:02:02 AM
rw-r-xr--
📄
Create_o.php
1.29 KB
05/27/2020 05:14:37 AM
rw-rw-r--
📄
Exception.php
1.18 KB
02/14/2020 06:08:53 AM
rw-r--r--
📁
Facebook
-
03/17/2019 06:15:28 AM
rwxrwxr-x
📄
LICENSE
25.91 KB
02/14/2020 06:08:20 AM
rw-r--r--
📄
OAuth.php
3.66 KB
02/14/2020 06:09:01 AM
rw-r--r--
📁
PHPMailer
-
08/07/2020 11:37:08 AM
rwxr-xr-x
📄
PHPMailer.php
160.5 KB
05/27/2020 05:14:39 AM
rw-r--r--
📄
POP3.php
10.76 KB
05/27/2020 05:14:39 AM
rw-r--r--
📄
README.md
4.1 KB
05/27/2020 05:14:39 AM
rw-rw-r--
📄
SECURITY.md
4.48 KB
05/27/2020 05:14:39 AM
rw-r--r--
📄
SMTP.php
43.16 KB
05/27/2020 05:14:39 AM
rw-r--r--
📄
VERSION
5 bytes
02/14/2020 06:08:32 AM
rw-r--r--
📄
auth.php
1.54 KB
05/27/2020 05:14:36 AM
rw-rw-r--
📄
auto-ajax.php
944 bytes
05/27/2020 05:14:36 AM
rw-rw-r--
📄
autosave.php
1.95 KB
05/27/2020 05:14:36 AM
rw-rw-r--
📄
body_insert.php
702 bytes
05/27/2020 05:14:36 AM
rw-rw-r--
📁
buffer
-
03/17/2019 06:13:29 AM
rwxr-xr-x
📄
canvas.html
1.79 KB
05/27/2020 05:14:36 AM
rw-r--r--
📄
canvas.php
4.77 KB
07/15/2020 02:09:48 AM
rw-r--r--
📄
change.php
3.18 KB
05/27/2020 05:14:36 AM
rw-rw-r--
📄
composer.json
1.52 KB
05/27/2020 05:14:36 AM
rw-r--r--
📄
config_twitter.php
359 bytes
05/27/2020 05:14:36 AM
rw-rw-r--
📄
confirmation.php
4.85 KB
05/27/2020 05:14:36 AM
rw-rw-r--
📄
cream.sql
1.78 MB
02/11/2020 11:29:52 AM
rw-rw-r--
📄
cs_view-new.php
4.77 KB
07/22/2020 11:35:27 AM
rw-r--r--
📁
css
-
07/13/2020 08:15:44 AM
rwxrwxr-x
📄
dashboard.php
781 bytes
05/27/2020 05:14:37 AM
rw-rw-r--
📄
dashboard2.php
408 bytes
05/27/2020 05:14:37 AM
rw-rw-r--
📄
dbConfig.php
423 bytes
05/27/2020 05:59:52 AM
rw-rw-r--
📄
dbconn.php
396 bytes
05/27/2020 05:14:37 AM
rw-rw-r--
📄
delete.php
405 bytes
05/27/2020 05:14:37 AM
rw-r-xr--
📄
delete_feed.php
432 bytes
08/09/2020 05:02:03 AM
rw-r--r--
📄
delete_gallery_image.php
462 bytes
07/12/2020 04:09:54 PM
rw-r--r--
📄
delete_newsletter.php
326 bytes
05/27/2020 05:14:37 AM
rw-r--r--
📄
delete_schedule.php
369 bytes
05/27/2020 05:14:37 AM
rw-rw-r--
📄
edit.php
7.59 KB
08/09/2020 05:02:06 AM
rw-r--r--
📄
edit_post.php
2.31 KB
05/27/2020 05:14:37 AM
rw-rw-r--
📁
editor
-
07/16/2019 10:20:37 AM
rwxrwxr-x
📄
editor.css
10.14 KB
05/27/2020 05:14:37 AM
rw-rw-r--
📄
editor.js
62.73 KB
05/27/2020 05:14:37 AM
rw-rw-r--
📄
editor.php
2.16 KB
05/27/2020 05:14:37 AM
rw-rw-r--
📄
ex.php
377 bytes
05/27/2020 05:14:37 AM
rw-rw-r--
📄
fetchrss.php
1.42 KB
07/19/2020 07:00:05 AM
rw-r--r--
📁
fonts
-
03/17/2019 06:15:39 AM
rwxrwxr-x
📄
footer.php
18 bytes
05/27/2020 05:14:37 AM
rw-rw-r--
📄
forgot_link.php
4.23 KB
08/05/2020 02:24:17 PM
rw-rw-r--
📄
forgotconfirmation.php
4.45 KB
02/11/2020 10:49:14 AM
rw-rw-r--
📄
forgotpassword.php
2.72 KB
08/05/2020 02:22:46 PM
rw-rw-r--
📁
form
-
03/17/2019 06:16:18 AM
rwxrwxr-x
📄
galery.php
2.75 KB
07/12/2020 04:10:17 PM
rw-r--r--
📄
galery_action.php
1.23 KB
07/21/2020 04:28:40 PM
rw-r--r--
📁
genai_backup
-
06/22/2024 04:21:20 AM
rwxr-xr-x
📄
get_account_action.php
1.15 KB
02/11/2020 12:27:03 PM
rw-rw-r--
📄
get_oauth_token.php
4.75 KB
05/27/2020 05:14:37 AM
rw-r--r--
📄
getaccount.php
3.95 KB
05/27/2020 05:14:37 AM
rw-rw-r--
📄
gulpfile.js
3.41 KB
05/27/2020 05:14:37 AM
rw-rw-r--
📄
header.php
9.06 KB
07/19/2020 09:00:59 AM
rw-r-xr--
📄
header_forbid.php
7.46 KB
02/11/2020 10:49:15 AM
rw-rw-r--
📄
header_publish.php
8.08 KB
07/13/2020 08:14:05 AM
rw-r--r--
📄
home.html
4.29 KB
05/27/2020 05:14:38 AM
rw-rw-r--
📄
home.php
8.93 KB
05/27/2020 05:14:38 AM
rw-rw-r--
📄
htdocstest.php
109 bytes
05/27/2020 05:14:38 AM
rw-r--r--
📄
image_check.php
102.74 KB
05/27/2020 05:14:38 AM
rw-r--r--
📁
images
-
07/15/2020 01:05:43 AM
rwxrwxr-x
📁
img
-
02/10/2020 02:47:45 PM
rwxrwxrwx
📄
index.html
4.2 KB
07/27/2020 04:25:39 AM
rw-rw-r--
📄
indexpost.php
1.09 KB
05/27/2020 05:14:38 AM
rw-rw-r--
📄
info.php
22 bytes
08/16/2020 09:58:32 AM
rw-r--r--
📄
j13publish.php
14.75 KB
07/13/2020 11:16:28 AM
rw-r--r--
📁
js
-
02/03/2020 12:32:50 PM
rwxrwxr-x
📄
js-login.php
1.83 KB
05/27/2020 05:14:38 AM
rw-rw-r--
📁
landing_page
-
02/03/2020 12:36:45 PM
rwxr-xr-x
📁
language
-
02/14/2020 06:07:47 AM
rwxr-xr-x
📄
latest_news.php
14.71 KB
07/13/2020 07:05:38 AM
rw-r-xr--
📁
linkedin-oauth
-
03/17/2019 06:19:17 AM
rwxrwxr-x
📄
linkedin_callback.php
2.94 KB
05/27/2020 05:14:38 AM
rw-rw-r--
📄
login.php
2.4 KB
05/27/2020 05:14:38 AM
rw-rw-r--
📄
logout.php
565 bytes
07/12/2020 04:10:56 PM
rw-r-xr--
📁
logs
-
03/17/2019 06:25:15 AM
rwxrwxr-x
📄
mailer.php
7.48 KB
08/07/2020 04:20:57 AM
rw-r--r--
📄
measure.php
4.53 KB
07/28/2020 01:07:53 PM
rw-r--r--
📄
meme.php
2.62 KB
07/12/2020 04:10:59 PM
rw-r--r--
📄
meme_image.php
1.54 KB
07/12/2020 04:24:15 PM
rw-r--r--
📄
menu.php
3.61 KB
07/15/2020 09:52:13 AM
rw-rw-r--
📄
mycollection.php
13.91 KB
08/09/2020 05:02:07 AM
rw-r--r--
📄
myfeeds.php
13 KB
05/31/2020 07:22:15 AM
rw-r-xr--
📄
mynewsletter.php
12.78 KB
02/11/2020 10:49:15 AM
rw-rw-r--
📄
mystudies.php
6.85 KB
05/20/2020 05:16:56 AM
rw-r--r--
📄
mystudiesaction.php
351 bytes
05/19/2020 08:49:42 AM
rw-r--r--
📄
nailer.php
28 bytes
04/11/2020 01:14:07 PM
rw-r--r--
📁
news
-
02/13/2020 02:12:09 PM
rwxrwxrwx
📄
newsignin.php
1.17 KB
07/13/2020 02:38:34 PM
rw-r--r--
📄
newsletter.php
23.38 KB
07/19/2020 06:37:38 AM
rw-r-xr--
📄
newssletterfooter.html
1013 bytes
05/27/2020 05:14:38 AM
rw-rw-r--
📄
newssletterheader.html
6.6 KB
05/27/2020 05:14:38 AM
rw-rw-r--
📄
o_canvas.php
2.79 KB
02/20/2020 07:02:31 AM
rw-r--r--
📄
old_view.php
5.5 KB
07/21/2020 03:26:55 PM
rw-r--r--
📄
package-lock.json
259.06 KB
05/27/2020 05:14:38 AM
rw-rw-r--
📄
package.json
1.38 KB
05/27/2020 05:14:38 AM
rw-rw-r--
📁
plugin
-
01/30/2020 07:02:22 AM
rwxr-xr-x
📄
publish.php
16.26 KB
07/15/2020 02:53:21 PM
rw-r--r--
📄
register.php
2.11 KB
05/27/2020 05:14:39 AM
rw-rw-r--
📁
resources
-
03/17/2019 06:19:24 AM
rwxrwxr-x
📄
rss_feed.php
8.05 KB
05/27/2020 05:14:39 AM
rw-rw-r--
📄
rss_submit.php
1.47 KB
05/27/2020 05:14:39 AM
rw-rw-r--
📄
rssfeed.php
9.52 KB
05/27/2020 05:14:39 AM
rw-rw-r--
📄
rssfeed2.php
8.29 KB
05/27/2020 05:14:39 AM
rw-rw-r--
📄
rssfeed_menu.php
8.62 KB
05/27/2020 05:14:39 AM
rw-rw-r--
📁
rssfeeds
-
03/17/2019 06:25:03 AM
rwxrwxr-x
📄
savepost.php
265 bytes
04/12/2020 06:43:59 AM
rw-r--r--
📄
schedule.php
808 bytes
05/27/2020 05:14:39 AM
rw-rw-r--
📄
schedule_list.php
3.51 KB
05/27/2020 05:14:39 AM
rw-rw-r--
📁
scss
-
02/03/2020 12:33:11 PM
rwxrwxr-x
📄
send.php
0 bytes
05/27/2020 05:14:39 AM
rw-r--r--
📄
sent.php
2.62 KB
08/08/2020 02:45:00 AM
rw-r--r--
📄
settings.php
23.82 KB
07/24/2020 04:53:32 AM
rw-r--r--
📄
signin.php
3.43 KB
07/23/2020 11:54:32 PM
rw-rw-r--
📄
signin_up.php
8.64 KB
07/24/2020 12:12:49 AM
rw-r--r--
📄
signup.php
5.68 KB
07/24/2020 12:12:50 AM
rw-r--r--
📄
style.css
36.8 KB
05/27/2020 05:14:40 AM
rw-rw-r--
📄
test1.php
39 bytes
05/27/2020 05:14:40 AM
rw-rw-r--
📁
test_folder
-
01/30/2020 09:29:30 AM
rwxrwxr-x
📄
test_post_15.php
771 bytes
05/27/2020 05:14:40 AM
rw-rw-r--
📄
tinymc.php
399 bytes
05/27/2020 05:14:40 AM
rw-r--r--
📁
tinymce
-
02/20/2020 05:35:36 AM
rwxr-xr-x
📄
twitter.php
1.94 KB
05/27/2020 05:14:40 AM
rw-rw-r--
📄
twitter_callback.php
1.49 KB
05/27/2020 05:14:40 AM
rw-rw-r--
📁
twitteroauth-0.7.4
-
03/17/2019 06:25:58 AM
rwxrwxr-x
📄
update_action.php
1.14 KB
06/03/2020 03:41:34 AM
rw-r--r--
📁
upload
-
08/21/2020 11:13:53 AM
rwxrwxrwx
📁
vendor
-
02/06/2020 10:24:08 AM
rwxr-xr-x
📄
view.php
5.5 KB
08/09/2020 01:54:43 PM
rw-r--r--
📄
z_signup.php
5.69 KB
07/15/2020 03:18:45 AM
rw-rw-r--
📄
zfetchrss.php
1.45 KB
05/27/2020 05:14:37 AM
rw-rw-r--
📄
zindex.php
8.18 KB
05/27/2020 05:14:38 AM
rw-r--r--
📄
zmeasure.php
4.36 KB
07/20/2020 04:41:27 AM
rw-r--r--
📄
zsettings.php
22.87 KB
05/27/2020 05:14:39 AM
rw-r-xr--
Editing: SECURITY.md
Close
# Security notices relating to PHPMailer Please disclose any vulnerabilities found responsibly - report any security problems found to the maintainers privately. PHPMailer versions prior to 6.0.6 and 5.2.27 are vulnerable to an object injection attack by passing `phar://` paths into `addAttachment()` and other functions that may receive unfiltered local paths, possibly leading to RCE. Recorded as [CVE-2018-19296](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-19296). See [this article](https://knasmueller.net/5-answers-about-php-phar-exploitation) for more info on this type of vulnerability. Mitigated by blocking the use of paths containing URL-protocol style prefixes such as `phar://`. Reported by Sehun Oh of cyberone.kr. PHPMailer versions prior to 5.2.24 (released July 26th 2017) have an XSS vulnerability in one of the code examples, [CVE-2017-11503](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-11503). The `code_generator.phps` example did not filter user input prior to output. This file is distributed with a `.phps` extension, so it it not normally executable unless it is explicitly renamed, and the file is not included when PHPMailer is loaded through composer, so it is safe by default. There was also an undisclosed potential XSS vulnerability in the default exception handler (unused by default). Patches for both issues kindly provided by Patrick Monnerat of the Fedora Project. PHPMailer versions prior to 5.2.22 (released January 9th 2017) have a local file disclosure vulnerability, [CVE-2017-5223](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5223). If content passed into `msgHTML()` is sourced from unfiltered user input, relative paths can map to absolute local file paths and added as attachments. Also note that `addAttachment` (just like `file_get_contents`, `passthru`, `unlink`, etc) should not be passed user-sourced params either! Reported by Yongxiang Li of Asiasecurity. PHPMailer versions prior to 5.2.20 (released December 28th 2016) are vulnerable to [CVE-2016-10045](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10045) a remote code execution vulnerability, responsibly reported by [Dawid Golunski](https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html), and patched by Paul Buonopane (@Zenexer). PHPMailer versions prior to 5.2.18 (released December 2016) are vulnerable to [CVE-2016-10033](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10033) a remote code execution vulnerability, responsibly reported by [Dawid Golunski](http://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html). PHPMailer versions prior to 5.2.14 (released November 2015) are vulnerable to [CVE-2015-8476](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8476) an SMTP CRLF injection bug permitting arbitrary message sending. PHPMailer versions prior to 5.2.10 (released May 2015) are vulnerable to [CVE-2008-5619](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5619), a remote code execution vulnerability in the bundled html2text library. This file was removed in 5.2.10, so if you are using a version prior to that and make use of the html2text function, it's vitally important that you upgrade and remove this file. PHPMailer versions prior to 2.0.7 and 2.2.1 are vulnerable to [CVE-2012-0796](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0796), an email header injection attack. Joomla 1.6.0 uses PHPMailer in an unsafe way, allowing it to reveal local file paths, reported in [CVE-2011-3747](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3747). PHPMailer didn't sanitise the `$lang_path` parameter in `SetLanguage`. This wasn't a problem in itself, but some apps (PHPClassifieds, ATutor) also failed to sanitise user-provided parameters passed to it, permitting semi-arbitrary local file inclusion, reported in [CVE-2010-4914](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4914), [CVE-2007-2021](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-2021) and [CVE-2006-5734](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-5734). PHPMailer 1.7.2 and earlier contained a possible DDoS vulnerability reported in [CVE-2005-1807](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-1807). PHPMailer 1.7 and earlier (June 2003) have a possible vulnerability in the `SendmailSend` method where shell commands may not be sanitised. Reported in [CVE-2007-3215](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-3215).