Informatics college. Directory browsing enabled.

Informatics college situated in Kathmandu promises its student that it will give you some knowledge about network security and all that fucking stuffz. Well the biggest problem is that the fuckers themself dont know about security. Take a look at this:

The following are the details of the server:
hostname:informatics.edu.np
uptime:803209s
last reboot:Thu July 08 9:36:45 2010
ip: 74.54.219.66
hostnames:(name-type)
informatics.edu.np-user
lamborghini.websitewelcome.com-PTR
OS-DD_WRT v23(linux kernel version 2.4.36)(ports used: 21,231)

The details are as follows:

Port	Protocol	State(0-open/x-filtered)	Service/version
7	TCP	X	echo
9	TCP	X	Discard
13	TCP	X	Daytime
21	TCP	0	ftp/PureFTPd
22	TCP	X	Ssh
25	TCP	X	SMTP
26	TCP	0	Smtp/EximSMTPd 469
53	TCP	0	Domain
80	TCP	0	http
110	TCP	0	Pop3/CourierPOP3d
135	TCP	X	Msrpc
139	TCP	X	Netbios-ssn
143	TCP	0	Imap/CourierIMAPd 2006 released
443	TCP	0
445	TCP	X	Microsoft-ds
465	TCP	0
993	TCP	0	Imap/CourierIMAPd2008 released
995	TCP	0
5800	TCP	X	Vnc-http
5900	TCP	x	vnc

also more than that i think that it is vulnerable to the sqli attack

url entered: http://www.informatics.edu.np/about_us.php?inst=asdasdvasdv
returned: ERROR: Unknown column 'asdasdvasdv' in 'where clause'

url entered:http://www.informatics.edu.np/course_matter.php?mid=asdvasdv
returned: Unknown column 'asdvasdv' in 'where clause'

also the college uses the webmail based in zimbra...you can look at milw0rm for the vuls of zimbra( i dont want to tell the which version it is....try this by your own)