phplivehelper-sqlexec.txt

`  
##########################################################  
# GulfTech Security Research August 16, 2008  
##########################################################  
# Vendor : Turnkey Web Tools, Inc  
# URL : http://www.turnkeywebtools.com  
# Version : PHP Live Helper <= 2.0.1  
# Risk : Multiple Vulnerabilities  
##########################################################  
  
  
Description:  
PHP Live Helper is an online support system written in php that  
allows the visitors of a website to interact in real time with  
the site owners. There are a number of issues in PHP Live Helper  
that allow for several different attacks such as SQL Injection,  
Variable Overwriting, and remote code execution. The issues  
require no authentication to exploit, and users are encouraged  
to upgrade as soon as possible.  
  
  
  
SQL Injection:  
There are a number of SQL Injection issues in PHP Live Helper  
that allow for an attacker to have arbitrary access to database  
contents such as administrator credentials. First, let's have a  
look at global.php @ lines 51-60  
  
function get ($table, $id, $from="id") {  
$result=$this->DB_site->query_first("SELECT * FROM ".  
$this->dbprefix.$table." where ".$from."='$id'");  
if (is_array($result)) {  
foreach ($result as $key => $val) {  
$info[$key] = stripslashes($val);  
}  
}  
return $info;  
}  
  
As we can see in the above code, all of the parameters passed to  
the get() function are unsanitized. So, if the data is not sanitized  
before being sent to get() we have an SQL Injection issue.  
  
/onlinestatus_html.php?dep=-99' UNION SELECT 1,2,3,4,5,6,7,8 FROM  
admin_accounts WHERE id=1 AND MID(password,1,1)=concat(char(50))/*  
  
An example of the vulnerable function being called can be seen in  
onlinestatus_html.php @ line 19. As a result a url like the one  
above can be used to enumerate the admin password for the PHP Live  
Helper installation. If there is a match to the specified character  
you will see an sql error, otherwise you will see an image file.  
  
  
  
Arbitrary Variable Overwriting:  
PHP Live Helper is vulnerable to a limited Variable Overwriting issue  
due to some faulty register globals emulation code. The vulnerable code  
in question can be found at libsecure.php @ lines 400-414  
  
unset ($_GET[abs_path]);  
$rg = ini_get ('register_globals');  
$getget_count = @count ($_GET);  
$getget_keys = @array_keys ($_GET);  
for ($i = 0; $i < $getget_count; ++$i)  
{  
$getget_name = $getget_keys[$i];  
$getget_value = $_GET[$getget_keys[$i]];  
$_GET[$getget_name] = strip_tags (urldecode ($getget_value));  
if ($rg == 1)  
{  
$$getget_name = strip_tags (urldecode ($getget_value));  
continue;  
}  
}  
  
The above code shows that variables can be overwritten, but because  
of where it is called, only variables from within the db config file  
can be overwritten (database info, and language file setting). This  
is enough though to allow an attacker to execute arbitrary code on the  
server by overwriting the table prefix variable with an arbitrary SQL  
query in order to gather the location of report files, and then  
overwriting the language file so that the report containing the  
malicious php code is included and executed. The odd thing is that this  
registers global emulation code is only called when register globals is  
already on, so it is kind of pointless.  
  
  
  
Arbitrary Code Execution:  
A different bit of code is set to run when register globals are off. The  
code in question is located in /includes/globalsoff.php and attempts to  
emulate register gloabls by recursively creating variables based on the  
GPC super globals. The problem is that all of the variable creation is  
done using eval() and thus allows for remote code execution.  
  
/chat.php?rg=0&test=";phpinfo();exit;//  
  
A url like the one shown above will successfully execute the specified  
arbitrary php code. It should be noted that by setting rg=0 an attacker  
can have this code ran regardless of register globals settings since if  
globals is on you can influence the "rg" parameter, and if it is off,  
the script runs as intended.  
  
  
  
Solution:  
The TurnKeyWebTools developers have addressed these issues in the latest  
version of PHP Live Helper which can be found at the following url.  
  
http://www.turnkeywebtools.com/esupport/index.php?_m=news&_a=viewnews&newsid=62   
  
  
  
Credits:  
James Bercegay of the GulfTech Security Research Team  
  
  
  
Related Info:  
The original advisory can be found at the following location  
http://www.gulftech.org/?node=research&article_id=00124-08162008  
`