[Dr.Exploit]

Crypto Exchange PHP

The first free Open-Source Crypto Exchange for all the community.

This script is completly tested and exchanges the coins without any trouble using the changenow.io api, and using the functions it's very easy to integrate it with a custom template.

Changenow.io is the best partner to have a as an exchange api provider since it pays you 90% of every transaction fee.

Features

- Add new coins
- Get money from setting changenow.io API and get 90% transaction fees.
- Show recent transactions
- Custom Login/Register system for users
- Transaction History
- Exchange Crypto
- Installation
- Download the directory to your root and configure the configs/database.php and configs/global.php
- Insert the database SQL
- Start your business !

How to add new coins

- Go to configs directory and edit coins.txt
- Put the coin in each line
- Save the file and it's done.

https://github.com/GMX9/Crypto-Exchange-PHP
https://cryptoexchange-software.us/

Wish to know your toughts.

If you want to check a demo , go to my website : https://demo.cryptoexchange-software.us/

[turbosoggy]

The design is really stunning. One thing i found is that the main page dosent 404 properly, for example demo.cryptoexchange-software.us/riuwahriuya just displays the main page instead of a 404

[Dr.Exploit]

The design is really stunning. One thing i found is that the main page dosent 404 properly, for example demo.cryptoexchange-software.us/riuwahriuya just displays the main page instead of a 404

Thanks alot.
Yes instead of using the error 404 i used index page to display so that it does not have broken pages, but i can submit a fix to it today or tomorrow !

[Dr.Exploit]

Looking for more input on this guys !

[SIM-3327349]

Thank you for sharing the source with us

[Abruptum]

Just wanted to say that there is a potential vulnerability in your code for the php version <5.3.4 due the handling of null bytes in the file_exists function.
https://github.com/GMX9/Crypto-Exchange-...rs.php#L34
The result would be a remote file inclusion attack against line :
https://github.com/GMX9/Crypto-Exchange-...rs.php#L36
if possible you should check your directory "modules" and then check if the name is contained in the directory over scandir(http://php.net/manual/de/function.scandir.php) if not then not even check the if the files exists.

or you can create a runtime check if the current php version is higher than >5.3.4 .

A small little patch should be done here also :
https://github.com/GMX9/Crypto-Exchange-...t.php#L152
sha1 is far to uncomplex, a 1-6 digit sha1 hash can be cracked within 49 minutes or less, so use sha256.

[TCP]

The result would be a remote file inclusion attack against line :
https://github.com/GMX9/Crypto-Exchange-...rs.php#L36

To allow remote inclusion allow_url_include must be set to On in php.ini

But yeah, this is a bad approach, you should never use unfiltered external input in file inclusion

[Dr.Exploit]

Just wanted to say that there is a potential vulnerability in your code for the php version <5.3.4 due the handling of null bytes in the file_exists function.
https://github.com/GMX9/Crypto-Exchange-...rs.php#L34
The result would be a remote file inclusion attack against line :
https://github.com/GMX9/Crypto-Exchange-...rs.php#L36
if possible you should check your  directory "modules" and then check if the name is contained in the directory over scandir(http://php.net/manual/de/function.scandir.php) if not then not even check the if the files exists.

or you can create a runtime check if the current php version is higher than >5.3.4 .

A small little patch should be done here also :
https://github.com/GMX9/Crypto-Exchange-...t.php#L152
sha1 is far to uncomplex, a 1-6 digit sha1 hash can be cracked within 49 minutes or less, so use sha256.

Thanks alot for your input mate !
Submited a fix related the path, check it out if you can.

Regarding the sha1 ill update it later today

Check this out :
https://github.com/GMX9/Crypto-Exchange-...39e62f0f22

---

To allow remote inclusion allow_url_include must be set to On in php.ini

But yeah, this is a bad approach, you should never use unfiltered external input in file inclusion

Yes was really bad of me, i let it pass completly unaware, i already sanitized the param and submited a fix with scandir

[Abruptum]

Thanks alot for your input mate !
Submited a fix related the path, check it out if you can.

Regarding the sha1 ill update it later today

Check this out :
https://github.com/GMX9/Crypto-Exchange-...39e62f0f22

---

Yes was really bad of me, i let it pass completly unaware, i already sanitized the param and submited a fix with scandir

I meaned that you could implement it in a way like this :

PHP Code


<?php 
$dirs = scandir("modules/");
$found = false;
foreach ($dirs as $dir){
    if($name == $dir && is_dir("modules/$dir")){
        $found = true;
        break;
    }
}
if($found && file_exists("modules/$name/controller/$name.php")){
    require_once("modules/$name/controller/$name.php");
    $module->index();
}else{
    require_once("modules/index/controller/index.php");
    $module->index();
} 


You should not use htmlentities or $connect->real_escape_string to secure when you want to search for a file it can lead to several problems regarding special characters which could be allowed.

[Dr.Exploit]

I meaned that you could implement it in a way like this :

PHP Code


<?php 
$dirs = scandir("modules/");
$found = false;
foreach ($dirs as $dir){
    if($name == $dir && is_dir("modules/$dir")){
        $found = true;
        break;
    }
}
if($found && file_exists("modules/$name/controller/$name.php")){
    require_once("modules/$name/controller/$name.php");
    $module->index();
}else{
    require_once("modules/index/controller/index.php");
    $module->index();
} 


You should not use htmlentities or $connect->real_escape_string to secure when you want to search for a file it can lead to several problems regarding special characters which could be allowed.

Thanks again ! I already submited your edit to the main repo !
https://github.com/GMX9/Crypto-Exchange-...39e62f0f22

What do you think generally of the organization and my mvc ?

[Abruptum]

Thanks again ! I already submited your edit to the main repo !
https://github.com/GMX9/Crypto-Exchange-...39e62f0f22

What do you think generally of the organization and my mvc ?

The organisation is done quite nice, sometimes even a bit overkill :D

[Dr.Exploit]

The organisation is done quite nice, sometimes even a bit overkill :D

:D thanks alot bud ! Let me know if ur interested in making something with me, you seem like a very good programmer , if u want just drop me a pm 🤝

[Abruptum]

:D thanks alot bud ! Let me know if ur interested in making something with me, you seem like a very good programmer , if u want just drop me a pm 🤝

Sure :) you can hit me up aswell when you want to do something.

[Dr.Exploit]

New Update Released:
Website : cryptoexchange-software.us

[Pink Floyd]

New Update Released:
Website : cryptoexchange-software.us

I am gonna use this now for my currency exchange software bud.
Can you reply to me on TG please you lost 👹