----------------------------------------------------------------------

Want a new job?

http://secunia.com/secunia_security_specialist/
http://secunia.com/hardcore_disassembler_and_reverse_engineer/

----------------------------------------------------------------------

TITLE:
QuickerSite Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA30501

VERIFY ADVISORY:
http://secunia.com/advisories/30501/

CRITICAL:
Highly critical

IMPACT:
Security Bypass, Cross Site Scripting, Manipulation of data, Exposure
of system information, System access

WHERE:
>From remote

SOFTWARE:
QuickerSite 1.x
http://secunia.com/product/14818/

DESCRIPTION:
AmnPardaz Security Research Team has reported multiple
vulnerabilities in QuickerSite, which can be exploited by malicious
people to bypass certain security restrictions, conduct cross-site
scripting attacks, script insertion attacks, SQL injection attacks,
and potentially compromise a vulnerable system.

1) The application does not properly restrict the access to several
functions of the "bs_login.asp" script. This can be exploited to e.g.
modify various settings including the administrator's password via
specially crafted URLs.

2) The application does not properly restrict the access to the
mailPage.asp script. This can be exploited to e.g to send spam
mails.

3) Input passed to the "close" parameter in showThumb.aspx is not
properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.

Note: Accessing this script without parameters may allow the
disclosure of the full path to the script.

4) Input passed to the parameters "SB_redirect" and "SB_feedback" in
process_send.asp and to "paramCode" and "cColor" in picker.asp is not
properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.

5) Input passed via the "X-FORWARDED-FOR", "QueryString", and
"Referer" HTTP headers is not properly sanitised before being used.
This can be exploited to inject arbitrary HTML and script code, which
is executed in an administrator's browser session if malicious data is
viewed.

6) The FCKEditor component allows uploading of arbitrary files. This
can be exploited to e.g. execute arbitrary ASP code by uploading
malicious ASP files.

7) Input passed to the "sNickName" parameter when changing the
nickname is not properly sanitised before being used in SQL queries.
This can be exploited to manipulate SQL queries by injecting
arbitrary SQL code.

The vulnerabilities are reported in version 1.8.5. Other versions may
also be affected.

SOLUTION:
Contact the vendor to receive hotfixes.

PROVIDED AND/OR DISCOVERED BY:
AmnPardaz Security Research Team

ORIGINAL ADVISORY:
http://bugreport.ir/index.php?/39

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------