QuickTalk v1.2 (Source code disclosure) Multiple Vulnerabilities

================================================================
QuickTalk v1.2 (Source code disclosure) Multiple Vulnerabilities 
================================================================

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    #######################################           1
0                    I'm indoushka member from Inj3ct0r Team           1
1                    #######################################           0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1


########################################################################
 
# Name: QuickTalk v1.2 (Source code disclosure) Multiple Vulnerabilities
 
# Vendor: http://www.qt-cute.org/
 
# Date: 2010-05-27
 
# Author : indoushka
 
# Thanks to : Inj3ct0r.com,Exploit-DB.com,SecurityReason.com,Hack0wn.com !
 
# Contact : [email protected]
 
# Home : www.arab-blackhat.co.cc
 
# Bug  : XSS
 
# Tested on : windows SP2 Fran?ais V.(Pnx2 2.0)
########################################################################
                                                                                                                                
# Dork : powered by QT-cute v1.2     
                                                                  
# Exploit By indoushka
 
Vulnerability description:
 
Looks like the source code for this script is available.
This check is using pattern matching to determine if server side tags are found in the file.
In some cases this may generate false positives.
 
Affected items:
 
/quicktalk/bin/config.txt
/quicktalk/bin/config_mysql.txt
/quicktalk/bin/config_odbc.txt
/quicktalk/bin/config_posgres.txt
/quicktalk/bin/config_sqlserver.txt
/quicktalk/bin/qtf_class_db.inc
/quicktalk/bin/qtf_class_forum.inc
/quicktalk/bin/qtf_class_post.inc
/quicktalk/bin/qtf_class_topic.inc
/quicktalk/bin/qtf_class_vip.inc
/quicktalk/bin/qtf_fn_limitsql.inc
/quicktalk/bin/qtf_fn_smtp.inc
/quicktalk/bin/qtf_init.inc
 
The impact of this vulnerability
An attacker can gather sensitive information (database connection strings, application logic) by analysing the source code.
This information can be used to conduct further attacks.
 
How to fix this vulnerability:
 
Remove this file from your website or change permissions in order to remove access.
  
Dz-Ghost Team ===== Saoucha * Star08 * Redda * theblind74 * XproratiX * onurozkan * n2n * Meher Assel ====================
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R * www.alkrsan.net * MR.SoOoFe * ThE g0bL!N
------------------------------------------------------------------------------------------------------------------------



#  0day.today [2018-01-10]  #