Quickblogger Remote File Include Vulnerability

Bugtraq ID:	20210
Class:	Input Validation Error
CVE:	CVE-2006-5081
Remote:	Yes
Local:	No
Published:	Sep 25 2006 12:00AM
Updated:	Jul 06 2016 02:00PM
Credit:	You_You has been credited with the discovery of this vulnerability.
Vulnerable:	QuickBlogger QuickBlogger 1.4
Not Vulnerable:

Quickblogger Remote File Include Vulnerability

Quickblogger is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

A successful exploit of this issue allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

Quickblogger version 1.4 is vulnerable to these issues.

Quickblogger Remote File Include Vulnerability

Attackers can exploit this issue via a web client.

The following proof-of-concept URI is available:

http://www.example.com/[path]/acc.php?page=attacker's_file

Quickblogger Remote File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Quickblogger Remote File Include Vulnerability

References:

• Quickblogger (Quickblogger)
  
• QB ( QuickBlogger ) =>1.4 Remote File Include Vulnerabilities (You_You)