This host is running PHP Quick Arcade and is prone to SQL injection and cross site scripting Vulnerabilities.

Successful exploitation will allow attacker to steal cookie-based authentication credentials, compromise the application, access or modify data. Impact Level: Application.

No solution or patch was made available for at least one year since disclosure of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one.

The flaws are due to, - Input validation errors in the 'Arcade.php' and 'acpmoderate.php' scripts when processing the 'phpqa_user_c' cookie or the 'id' parameter, which could be exploited by malicious people to conduct SQL injection attacks. - Input validation error in the 'acpmoderate.php' script when processing the 'serv' parameter, which could allow cross site scripting attacks.

PHP-Quick-Arcade version 3.0.21 and prior.

• http://packetstormsecurity.org/1004-exploits/phpquickarcade-sqlxss.txt
• http://www.exploit-db.com/exploits/12416/
• http://www.vupen.com/english/advisories/2010/1013

---

Updated on 2015-03-25