vendor:
ProQuiz
by:
L0n3ly-H34rT
7,5
CVSS
HIGH
Remote File Include, Local File Include, Remote SQL Injection & Blind SQL Injection
94, 98, 89, 79
CWE
Product Name: ProQuiz
Affected Version From: 2.0.2
Affected Version To: 2.0.2
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Linux/Windows
2012
ProQuiz v2.0.2 – Multiple Vulnerabilities
ProQuiz v2.0.2 is vulnerable to Remote File Include, Local File Include, Remote SQL Injection & Blind SQL Injection. In File (my_account.php) in line 114 & 115, if($_GET['action']=='getpage' && !empty($_GET['page'])){@include_once($_GET['page'].'.php'); is vulnerable to Remote File Include & Local File Include. For Remote File Include, an attacker can register and login in the panel and paste the malicious URL. For Local File Include, an attacker can register and login in the panel and paste the malicious URL. For Remote SQL Injection & Blind SQL Injection, in two files, answers.php in line 55 and functions.php in $_POST['email'] and $_POST['username'], an attacker can inject malicious SQL code in the URL and POST method.
Mitigation:
To mitigate Remote File Include & Local File Include, the application should use a whitelist of allowed files and should not rely on the client to provide the file name. To mitigate Remote SQL Injection & Blind SQL Injection, the application should use parameterized queries and should not rely on the client to provide the query.
