Quick.Forum 'topic field' XSS and 'page' & 'iCategory' SQL injection

#######################################################
Quick.Forum 'topic field' XSS and 'page' & 'iCategory' SQL injection
vendor url:http://qc.dotgeek.org/os/index.php
advisore:http://lostmon.blogspot.com/2005/05/
quickforum-topic-field-xss-and-page.html
vendor notify: yes exploit available: yes
OSVDB ID:16326, 16327, 16328 , 16329
Secunia: SA15200
BID:13602
######################################################

Quick.Forum contais a flaw which can be exploited by malicious people to conduct cross-site scripting and SQL injection attacks.

Input passed to the "topic" field in "index.php" isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML, script code and in a user's browser session in context of a vulnerable site.

Input passed to the "iCategory" and "page" variables in "index.php" isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code


########
versions
########

2.1.6 afected

It is posible to prior versions are vulnerable too.

#############
solution
#############

no solution available at this time

#########
timeline
#########

discovered:28 april 2005
vendor notify: 10 may 2005 (webform)
vendor response:
vendor fix:
disclosure:11 mayo 2005

##################
proof of comcepts
##################
###############
SQL injections
###############

http://[victim]/forum/index.php?p=&iCategory=3%20or%201=1

http://[victim]/forum/index.php?p=topicsList&page=4%20or%201=1

http://[victim]/forum/?p=&iCategory=2%20or%201=1

########
XSS
########

http://[victim]/forum/?p=newTopic // topic field are vulnerable to XSS


################
some information
################

non important information , not need password to post

http://[victim]/forum/db/users.txt //show all users of forum.

http://[victim]/forum/db/banList.txt //list of all IP banned

http://[victim]/forum/db/censureWords.txt //all censured words

the backup of the database are stored in
http://[victim]/forum/backup/qf20050509.tar.bz2
and the file have the same name of the date was made the backup,
it can download directly ,but need to know the name of the file :P


###################### End ################

thnx to estrella to be my ligth
Thnx to icaro he is my Shadow !!!
thnx to all http://www.osvdb.org Team
thnx to all who day after day support me !!!
--
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Data Mangler of: http://www.osvdb.org
--
La curiosidad es lo que hace mover la mente