 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
 |
[waraxe-2004-SA#036] [Multiple security holes in PhpNuke] |
 |
 Posted: Sun Jul 18, 2004 5:38 pm |
 |
|
| genoxide |
| Regular user |
 |
|
| Joined: Jun 14, 2004 |
| Posts: 15 |
|
|
|
 |
|
 |
|
Ok i've tested this report on nuke 6.9 and 7.3 and heres my 2 cents 
| Quote: | A1 - full path disclosure in "/modules/Search/index.php":
Go to search page:
http://localhost/nuke73/modules.php?name=Search
and enter to search field "**" (without double quotes).
Or enter plus sign "+".
As result there will be standard php error messages, revealing full path:
Warning: eregi(): REG_BADRPT: in D:\apache_wwwroot\nuke73\modules\Search\index.php on line 228
Warning: eregi(): REG_BADRPT: in D:\apache_wwwroot\nuke73\modules\Search\index.php on line 232
Warning: eregi(): REG_BADRPT: in D:\apache_wwwroot\nuke73\modules\Search\index.php on line 235 |
Don't get any off those errors, maybe my php.ini? 
$sid = intval($_POST['sid']);
$max = intval($_POST['max']);
$sel1 = '';
$sel2 = '';
$sel3 = '';
$sel4 = '';
$sel5 = '';
$match = '';
$mod1 = '';
$mod2 = '';
$mod3 = '';
| Quote: | C - Sql Injection
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
C1 - noncritical sql injection case in "/modules/Search/index.php":
Reason is unsanitized user-submitted variable "$min", which gets delievered directly
to sql request, afrer "ORDER BY / LIMIT" keywords. In mysql version 4.0 its not useful for exploiting,
but in case of new version 4.1, where subselects functionality will be available, there will be
possibility to use blind sql injection methods. So - this security bug must be fixed ASAP.
C2 - critical sql injection case in "/modules/Search/index.php":
Yeah, yeah, yeah - AGAIIIIIN! Fatal sql injection...
"Use the Source, Luke" --> let's look @ original code
----------------[ original source ]-----------------
$query = addslashes($query);
if ($type=="stories" OR !$type)
{
if ($category > 0)
{
$categ = "AND catid='$category' ";
}
elseif ($category == 0)
{
$categ = "";
}
$q = "select s.sid, s.aid, s.informant, s.title, s.time, s.hometext, s.bodytext,
a.url, s.comments, s.topic from ".$prefix."_stories s, ".$prefix."_authors a
where s.aid=a.aid $queryalang $categ";
if (isset($query)) $q .= "AND (s.title LIKE '%$query%' OR s.hometext LIKE '%$query%'
OR s.bodytext LIKE '%$query%' OR s.notes LIKE '%$query%') ";
if ($author != "") $q .= "AND s.aid='$author' ";
if ($topic != "") $q .= "AND s.topic='$topic' ";
if ($days != "" && $days!=0) $q .= "AND TO_DAYS(NOW()) - TO_DAYS(time) <= '$days' ";
$q .= " ORDER BY s.time DESC LIMIT $min,$offset";
$t = $topic;
$result5 = $db->sql_query($q);
----------------[/original source ]-----------------
What we can see here, is that construction "if/elseif" misses ending part "/else".
And if we deliver there "$category" as < 0, then variable "$categ" will be uninitialized.
So - let's get dirty
----------------[ real life exploit ]---------------
http://localhost/nuke73/modules.php?name=Search&type=stories&query=f00bar&category=-1
&categ=%20and%201=2%20UNION%20SELECT%200,0,aid,pwd,0,0,0,0,0,0%20from%20nuke_authors/* |
there are 2 ways of doing this
#1 by making $categ = intval($categ);
#2 changing the code to:
| Code: | if ($type=="stories" OR !$type)
{
if ($category > 0)
{
$categ = "AND catid='$category' ";
}
elseif ($category == 0)
{
$categ = "";
} else {
$categ = "";
}
|
cheers |
|
|
|
|
|
|
|
|
| Posted: Thu Aug 05, 2004 2:05 am |
|
|
| chatserv |
| Beginner |
 |
|
| Joined: May 18, 2004 |
| Posts: 4 |
|
|
|
|
|
|
|
For the last one this should be enough:
| Code: | if ($type=="stories" OR !$type)
{
if ($category > 0)
{
$categ = "AND catid='$category' ";
} else {
$categ = "";
} |
Originally the string checks if $category is greater than 0 give $categ a value else if $category equals 0 make $categ blank else make $categ blank, with the modified string it now reads if $category is greater than 0 give $categ a value else for all other conditions make $categ blank, one less check, same results. |
|
|
|
|
|
|
|
|
| Posted: Thu Aug 05, 2004 2:11 am |
|
|
| chatserv |
| Beginner |
|
|
| Joined: May 18, 2004 |
| Posts: 4 |
|
|
|
|
|
|
|
On that note the module has another vulnerability where a variable that was left wide open is being exploited: $instory, consider the following block of code:
| Code: | } elseif ($type=="comments") {
/*
$sid = intval($sid);
if (isset($sid)) {
$row7 = $db->sql_fetchrow($db->sql_query("SELECT title from ".$prefix."_stories where sid='$sid'"));
$st_title = $row7['title'];
$instory = "AND sid='$sid'";
} else {
$instory = "";
}
*/
$result8 = $db->sql_query("SELECT tid, sid, subject, date, name from ".$prefix."_comments where (subject like '%$query%' OR comment like '%$query%') $instory order by date DESC limit $min,$offset"); |
$instory gets used in the query but the block of code in which it gets set was commented out, hence no actual value gets defined for it nor is it validated, removing $instory from the query should take care of that one. |
|
|
|
|
|
www.waraxe.us Forum Index -> How to fix
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
Discussions
Tools
Content
Info
Membership:
Latest: 
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 98
Members: 0
Total: 98
