isaychris / sinkd Goto Github PK

Hey, there is a security vulnerability in your project that gave me the possiblity to execute code on the hosted server.

The fact that you are allowing file upload on your server is good. But, you should protect your form by retricting the file extension. I could use this to upload a php file and execute code on the server.

PS: in db.php there is also a SQL Injection :)

$qresult = $link->query("SELECT * FROM login WHERE username='$username'");

I thing you may document yourself about IT Security before publishing code on internet. It can cause you a lot more troubles