CSFR being solved using SESSION-TOKEN
CAPTCHA for Contact Us Form
COMMENT variable in USER problem solved
Another HIDDEN field solved in Comments section
FINISH CSRF
INFORMATION EXPOSURE, Leakage, couple files deleted
OPEN REDIRECT done, hopefully