Exploit cPickle.loads which deserialize object from untrusted user input session['auth'] inside verifySession() function.

Bypass Python urlparse function

Every registered user can change every account because `Request

Exploit Mako Templates for Python.

$_GET['order'] is not escaped.

Use XSS Auditor for XSS bypass

SQL Injection because of shift-jis encoding.

In PHP when hash looks like 0e[0-9]* and are compared using == it is treated as exponent