antz > 08-01-2018, 02:34 AM
PHP Quick Arcade 3.0.21 Multiple Vulnerabilites
-----------------------------------------------------------
#Title: PHP-Quick-Arcade 3.0.21 Multiple Vulnerabilites
#Vendor: http://quickarcade.jcink.com/
-----------------------------------------------------------
#AUTHOR: ITSecTeam
#Email: [email protected]
#Website: http://www.itsecteam.com
#Forum : http://forum.ITSecTeam.com
#Original Advisory: www.ITSecTeam.com/en/vulnerabilities/vulnerability47.htm
#Thanks: Pejvak,[email protected],r3dm0v3,am!rkh@n
-----------------------------------------------------------
# POC 1
-----------------------------------------------------------
www.Site.com/Arcade.php
Send Your Query With Cookie => phpqa_user_c
phpqa_user_c= Sql Injection
Can Use tamper data in mozila
-----------------------------------------------------------
# POC 2
-----------------------------------------------------------
This Bug Worked With Register_Global = On
www.Site.com/acpmoderate.php?id=Sql Injection
-----------------------------------------------------------
# POC 3
-----------------------------------------------------------
Cross Site Scripting (XSS)
www.Site.com/acpmoderate.php?serv=Xss Code