Description
Multiple SQL injection vulnerabilities in QuickTicket 1.2 build:20070621 and QuickTalk Forum 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) t and (2) f parameters in (a) qti_ind_post.php and (b) qti_ind_post_prt.php; (3) dir and (4) order parameters in qti_ind_member.php; (5) id parameter in qti_usr.php; and the (6) f parameter in qti_ind_topic.php. NOTE: it was later reported that vector 5 also affects 1.4, 1.5, and 1.5.0.3.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- QuickTicket 1.5 - 'qti_usr.php' SQL Injection EDB-5222 · webapps · Mar 9, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 29299 third-party-advisory
- quicktalkforum-multiple-sql-injection(35100) vdb-entry
- 38957 vdb-entry
- http://pridels-team.blogspot.com/2007/06/quickticket-multiple-sql-inj.html
- 42684 vdb-entry
- 5222 exploit
- 37606 vdb-entry
- ADV-2007-2367 vdb-entry
- 28176 vdb-entry
- 38958 vdb-entry
- quickticket-qtiusr-sql-injection(41065) vdb-entry
- 38959 vdb-entry
- 38956 vdb-entry