nst-30.txt

`/*  
--------------------------------------------------------  
[N]eo [S]ecurity [T]eam [NST] - Advisory 30 - 2006-11-24  
--------------------------------------------------------  
Program: PHP-Nuke  
Homepage: http://www.phpnuke.org  
Vulnerable Versions: PHP-Nuke <= 7.9  
Risk: Medium  
Impact: Medium Risk  
  
-==PHP-Nuke <= 7.9 News module "sid" SQL Injection vulnerabilities==-  
---------------------------------------------------------  
  
- Description  
---------------------------------------------------------  
PHP-Nuke is a news automated system specially designed to be used in  
Intranets and Internet. The Administrator has total control of his web site,  
registered users, and he will have in the hand a powerful assembly of tools  
to maintain an active and 100% interactive web site using databases.  
  
- Tested  
---------------------------------------------------------  
localhost & many sites  
  
- Vulnerability Description  
---------------------------------------------------------  
  
In /modules/News/index.php the "sid" variable is not sanitized correctly.  
Here is the vulnerable code:  
  
==[ /modules/News/index.php 140-142 ]=============================  
[...]  
OpenTable();  
$row = $db->sql_fetchrow($db->sql_query("SELECT title FROM  
".$prefix."_stories WHERE sid='$sid'"));  
$row[title] = filter($row[title], "nohtml");  
[...]  
==[ end /modules/News/index.php ]=================================  
  
That code is in the rate_article() function. The same bug is present at the  
rate_complete() function in the same file:  
  
==[ /modules/News/index.php 245-246 ]=============================  
[...]  
$row = $db->sql_fetchrow($db->sql_query("SELECT title FROM  
".$prefix."_stories WHERE sid='$sid'"));  
$row[title] = filter($row[title], "nohtml");  
==[ end /modules/News/index.php ]=================================  
  
magic_quotes_gpc php directive must be turned Off so the simple quotes (')  
are not filtered. Also we have to know the prefix  
used for the database tables ("nuke_" by default).  
  
In this way, bypassing the SQL Injection Protection, like using someone like  
'UNION/**/' and not ' UNION ' in our sql injections, we can get the admin  
md5 hash by sending a malicious GET request.  
  
==Pseudo-Code Proof of Concept exploit==  
<?  
/*  
  
Neo Security Team - Pseudo-Code Proof of Concept Exploit  
http://www.neosecurityteam.net  
Paisterist  
  
*/  
set_time_limit(0);  
$host="localhost";  
$path="/phpnuke/";  
$port="80";  
$fp = fsockopen($host, $port, $errno, $errstr, 30);  
  
if ($fp) {  
/* we put the GET request on $p variable, with "sid" containing. */  
  
fwrite($fp, $p);  
  
while (!feof($fp)) {  
$content .= fread($fp, 4096);  
}  
  
preg_match("/([a-z0-9]{32})/", $content, $matches);  
  
if ($matches[0])  
print "<b>Hash: </b>".$matches[0];  
}  
?>  
==Pseudo-Code Proof of Concept exploit==  
  
Whit this PoC code i get the md5 hash of the first admin (God) of the  
nuke_authors table.  
  
- How to fix it? More information?  
--------------------------------------------------------  
  
You can found a patch on http://www.neosecurityteam.net/foro/  
  
Also, you can modify add in the /index.php file some like this:  
  
$sid = ($_GET['sid']) ? intval($_GET['sid']) : intval($_POST['sid']);  
  
That's a momentary solution to the problem. I recommend to download the  
PHP-Nuke 8.0 version in the next days... it is not  
free at the moment.  
  
- References  
--------------------------------------------------------  
http://www.neosecurityteam.net/index.php?action=advisories&id=30  
  
- Credits  
--------------------------------------------------------  
News module SQL Injection discovered by Paisterist -> paisterist[dot]nst  
[at] gmail[dot]com  
  
[N]eo [S]ecurity [T]eam [NST] - http://www.neosecurityteam.net/  
  
  
- Greets  
--------------------------------------------------------  
HaCkZaTaN  
K4P0  
Daemon21  
Link  
0m3gA_x  
NitRic  
LINUX  
nitrous  
m0rpheus  
nikyt0x  
KingMetal  
Knightmare  
  
Argentina, Colombia, Chile, Bolivia, Uruguay EXISTS!!  
  
@@@@'''@@@@'@@@@@@@@@'@@@@@@@@@@@  
'@@@@@''@@'@@@''''''''@@''@@@''@@  
'@@'@@@@@@''@@@@@@ @@@'''''@@@  
'@@'''@@@@'''''''''@@@''''@@@  
@@@@''''@@'@@@@@@@@@@''''@@@@@  
  
/* EOF */  
  
  
--   
Paisterist  
  
Neo Security Team http://neosecurityteam.net  
`