/*
--------------------------------------------------------
[N]eo [S]ecurity [T]eam [NST] - Advisory 30 - 2006-11-24
--------------------------------------------------------
Program: PHP-Nuke
Homepage: http://www.phpnuke.org
Vulnerable Versions: PHP-Nuke <= 7.9
Risk: Medium
Impact: Medium Risk

-==PHP-Nuke <= 7.9 News module "sid" SQL Injection vulnerabilities==-
---------------------------------------------------------

- Description
---------------------------------------------------------
PHP-Nuke is a news automated system specially designed to be used in
Intranets and Internet. The Administrator has total control of his web site,
registered users, and he will have in the hand a powerful assembly of tools
to maintain an active and 100% interactive web site using databases.

- Tested
---------------------------------------------------------
localhost & many sites

- Vulnerability Description
---------------------------------------------------------

In /modules/News/index.php the "sid" variable is not sanitized correctly.
Here is the vulnerable code:

==[ /modules/News/index.php 140-142 ]=============================
[...]
OpenTable();
$row = $db->sql_fetchrow($db->sql_query("SELECT title FROM
".$prefix."_stories WHERE sid='$sid'"));
$row[title] = filter($row[title], "nohtml");
[...]
==[ end /modules/News/index.php ]=================================

That code is in the rate_article() function. The same bug is present at the
rate_complete() function in the same file:

==[ /modules/News/index.php 245-246 ]=============================
[...]
$row = $db->sql_fetchrow($db->sql_query("SELECT title FROM
".$prefix."_stories WHERE sid='$sid'"));
$row[title] = filter($row[title], "nohtml");
==[ end /modules/News/index.php ]=================================

magic_quotes_gpc php directive must be turned Off so the simple quotes (')
are not filtered. Also we have to know the prefix
 used for the database tables ("nuke_" by default).

In this way, bypassing the SQL Injection Protection, like using someone like
'UNION/**/' and not ' UNION ' in our sql injections, we can get the admin
md5 hash by sending a malicious GET request.

==Pseudo-Code Proof of Concept exploit==
<?
/*

Neo Security Team - Pseudo-Code Proof of Concept Exploit
http://www.neosecurityteam.net
Paisterist

*/
set_time_limit(0);
$host="localhost";
$path="/phpnuke/";
$port="80";
$fp = fsockopen($host, $port, $errno, $errstr, 30);

if ($fp) {
    /* we put the GET request on $p variable, with "sid" containing. */

    fwrite($fp, $p);

    while (!feof($fp)) {
        $content .= fread($fp, 4096);
    }

    preg_match("/([a-z0-9]{32})/", $content, $matches);

    if ($matches[0])
    print "<b>Hash: </b>".$matches[0];
}
?>
==Pseudo-Code Proof of Concept exploit==

Whit this PoC code i get the md5 hash of the first admin (God) of the
nuke_authors table.

- How to fix it? More information?
--------------------------------------------------------

You can found a patch on http://www.neosecurityteam.net/foro/

Also, you can modify add in the /index.php file some like this:

$sid = ($_GET['sid']) ? intval($_GET['sid']) : intval($_POST['sid']);

That's a momentary solution to the problem. I recommend to download the
PHP-Nuke 8.0 version in the next days... it is not
free at the moment.

- References
--------------------------------------------------------
http://www.neosecurityteam.net/index.php?action=advisories&id=30

- Credits
--------------------------------------------------------
News module SQL Injection discovered by Paisterist -> paisterist[dot]nst
[at] gmail[dot]com

[N]eo [S]ecurity [T]eam [NST] - http://www.neosecurityteam.net/


- Greets
--------------------------------------------------------
HaCkZaTaN
K4P0
Daemon21
Link
0m3gA_x
NitRic
LINUX
nitrous
m0rpheus
nikyt0x
KingMetal
Knightmare

Argentina, Colombia, Chile, Bolivia, Uruguay EXISTS!!

@@@@'''@@@@'@@@@@@@@@'@@@@@@@@@@@
'@@@@@''@@'@@@''''''''@@''@@@''@@
'@@'@@@@@@''@@@@@@ @@@'''''@@@
'@@'''@@@@'''''''''@@@''''@@@
@@@@''''@@'@@@@@@@@@@''''@@@@@

/* EOF */


-- 
Paisterist

Neo Security Team http://neosecurityteam.net