[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

QuickTalk v1.2 (Source code disclosure) Multiple Vulnerabilities

Author
indoushka
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-12483
Category
web applications
Date add
31-05-2010
Platform
php
================================================================
QuickTalk v1.2 (Source code disclosure) Multiple Vulnerabilities 
================================================================

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    #######################################           1
0                    I'm indoushka member from Inj3ct0r Team           1
1                    #######################################           0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1


########################################################################
 
# Name: QuickTalk v1.2 (Source code disclosure) Multiple Vulnerabilities
 
# Vendor: http://www.qt-cute.org/
 
# Date: 2010-05-27
 
# Author : indoushka
 
# Thanks to : Inj3ct0r.com,Exploit-DB.com,SecurityReason.com,Hack0wn.com !
 
# Contact : indoushka@hotmail.com
 
# Home : www.arab-blackhat.co.cc
 
# Bug  : XSS
 
# Tested on : windows SP2 Fran?ais V.(Pnx2 2.0)
########################################################################
                                                                                                                                
# Dork : powered by QT-cute v1.2     
                                                                  
# Exploit By indoushka
 
Vulnerability description:
 
Looks like the source code for this script is available.
This check is using pattern matching to determine if server side tags are found in the file.
In some cases this may generate false positives.
 
Affected items:
 
/quicktalk/bin/config.txt
/quicktalk/bin/config_mysql.txt
/quicktalk/bin/config_odbc.txt
/quicktalk/bin/config_posgres.txt
/quicktalk/bin/config_sqlserver.txt
/quicktalk/bin/qtf_class_db.inc
/quicktalk/bin/qtf_class_forum.inc
/quicktalk/bin/qtf_class_post.inc
/quicktalk/bin/qtf_class_topic.inc
/quicktalk/bin/qtf_class_vip.inc
/quicktalk/bin/qtf_fn_limitsql.inc
/quicktalk/bin/qtf_fn_smtp.inc
/quicktalk/bin/qtf_init.inc
 
The impact of this vulnerability
An attacker can gather sensitive information (database connection strings, application logic) by analysing the source code.
This information can be used to conduct further attacks.
 
How to fix this vulnerability:
 
Remove this file from your website or change permissions in order to remove access.
  
Dz-Ghost Team ===== Saoucha * Star08 * Redda * theblind74 * XproratiX * onurozkan * n2n * Meher Assel ====================
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R * www.alkrsan.net * MR.SoOoFe * ThE g0bL!N
------------------------------------------------------------------------------------------------------------------------



#  0day.today [2024-12-24]  #