1) Will I get reply for all submissions even if rejected ?
May be it depends on their (admins) mood.
Any way the rules are here....
Rules
- You must disclose the vulnerability only to me. Do not test your vulnerability in such a way that it would give others any information about the vulnerability.
- I must not already know about the vulnerability.
- Your info must actually convince me to make changes. If you give me info that is insufficient to convince me to change things, and then a few months later I get more info from someone else which does convince me to fix the thing that you reported, then you'll likely not be awarded a bounty.
- You must not use your exploit in any malicious way, or use it to read any database info that isn't public except for accounts that you control.
- It must be fairly easy for me to check the validity of your vulnerability. You must have proof of concept code, a live example of the exploit on the forum, or a very detailed description of the vulnerability. You can't just say something like, "Avatars can be used to execute PHP." That's not enough information, and it's very likely that the vulnerability you're talking about won't even affect the forum. Attacks using brute-force, timing, etc. that you can't demonstrate may not be eligible for bounties.
- DoS attacks aren't security vulnerabilities.
- Compromising an admin account is a valid technique, but you can't assume that you will be able to do this.
- Assume that CSRF attacks against the admin console don't work.
- If an exploit is only possible due to a combination of two or more flaws, then the bounty is calculated for each flaw assuming that it alone would succeed in the attack, and you get only the smallest of these bounties.
You should be reading this when
vit05 gave you the link at the first place.
