PHP Quick Arcade 3.0.21 – Multiple Vulnerabilities
PHP Quick Arcade 3.0.21 Multiple Vulnerabilites ----------------------------------------------------------- #Title: PHP-Quick-Arcade 3.0.21 Multiple Vulnerabilites #Vendor: http://quickarcade.jcink.com/ ----------------------------------------------------------- #AUTHOR: ITSecTeam #Email: Bug@ITSecTeam.com #Website: http://www.itsecteam.com #Forum : http://forum.ITSecTeam.com #Original Advisory: www.ITSecTeam.com/en/vulnerabilities/vulnerability47.htm #Thanks: Pejvak,M3hr@n.s,r3dm0v3,am!rkh@n ----------------------------------------------------------- # POC 1 ----------------------------------------------------------- www.Site.com/Arcade.php Send Your Query With Cookie => phpqa_user_c phpqa_user_c= Sql Injection Can Use tamper data in mozila ----------------------------------------------------------- # POC 2 ----------------------------------------------------------- This Bug Worked With Register_Global = On www.Site.com/acpmoderate.php?id=Sql Injection ----------------------------------------------------------- # POC 3 ----------------------------------------------------------- Cross Site Scripting (XSS) www.Site.com/acpmoderate.php?serv=Xss Code |