Revisiting Guruji

Sigh!!! I reported like so many bugs and vulnerabilities in www.guruji.com in my post Unsafe Guruji. Never heard back from them, but I was kind of happy to see that they fixed some issues.

They plugged the obvious XSS vulnerabilities (haven't tried the unobvious vulnerabilities).

But what sucks is this.
Try giving an empty search string to guruji on the first page. They have a javascript to check if the string is empty and throw a popup "Please Enter a Valid query".

This is what the JavaScript code looks like.

function check() {
if (document.form.q.value == "")
{
alert("Please Enter A Valid Query");
return false;
}
else
{
return true;
}

Now try putting in a space and sending the query. It throws up some random word in the text box and the result asks you to enter a valid query.
I saw "maulanaazaad","hll,lux advertising strategy","jenifer lopez" pop up. I was bamboozled why this was happening and then cracked it, all the site was doing was putting in the last search query in the text box. Not just your last query, the last query of anyone who searched on guruji.
So if you want to see what others are searching on guruji, enter a space in the box and keep pressing the search button. If you get a page where the text box is empty then it is because no one entered a valid search and your blank search is being shown in the text box.


Do these guys have testing folks or what.. Mark my words, test user input on frontend and backend, javascript alone is not a solution to all problems and if you use javascripts be consistent. I say this because on the landing page of the search you can still enter empty queries.

I am not going to send this post to them (like they care anyways), you guys and go have fun checking out what others are searching for.

You can do that by clicking here