SNS Vulnerability

QT-cute QuickTeam "qte_web_path" and "qte_root" File Inclusion Issues

Description

Multiple vulnerabilities have been identified in QT-cute QuickTeam, which could be exploited by attackers to execute arbitrary commands. These issues are caused by input validation errors in the "qte_web.php" and "bin/qte_init.php" scripts when processing the "qte_web_path" and "qte_root" parameters, which could be exploited by remote attackers to include malicious scripts and execute arbitrary commands with the privileges of the web server.

Vulnerable Products

Vulnerable Software:
QT-cute QuickTeam version 2.0

Solution

CVE

CVE-2009-1551

References

http://www.milw0rm.com/exploits/8602

Vulnerability Manager Detection

IPS Protection

ASQ Engine alarm	Available Since
Misc : Directory traversal - parameter starting with ../	3.2.0
PHP : Remote file inclusion prevention : suspicious root_path parameter found in URL	3.2.0
Directory traversal using ..\..	3.2.0
Directory traversal	3.2.0
PHP : Remote file inclusion prevention : URL found as parameter	3.2.0
Directory traversal backward root folder	3.2.0

Risk level

High

Vulnerability First Public Report Date

2009-05-05

Target Type

Server

Possible exploit

Local & Remote