Info

Disclosure

May 11, 2005

Discovery

Apr 28, 2005

Dates

Exploit

May 11, 2005

Solution

Unknown

Description

Quick.Forum contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the 'iCategory' and 'page' variables in the 'index.php' script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.

Classification

Location: Remote/Network Access Required
Attack Type: Information Disclosure, Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity
Exploit: Exploit Available
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

Open Solution

Quick.Forum

2.1.6

References

Secunia Advisory ID: 15200
Related OSVDB ID: 16327 16328 16329
CVE ID: 2005-1585 (see also: NVD)
Other Advisory URL: http://lostmon.blogspot.com/2005/05/quickforum-topic-field-xss-and-page.html
Vendor URL: http://qc.dotgeek.org/os/index.php?p=productsQuickForum

Credit

Lostmon Lords - Lostmongmail.com -

Direct URL: http://osvdb.org/36218