 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
 |
[waraxe-2004-SA#030] - Multiple vulnerabilities in PhpNuke |
 |
 Posted: Mon May 17, 2004 6:09 pm |
 |
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
 |
|
 |
|
Here are my patches for PhpNuke 7.3 version, but they will apply with possible minor changes, to older versions too. If you have problems with the patches, or wanna suggest better solutions, or have additional questions - post them here and discuss it with other members.
1. Look at "modules/Web_Links/index.php" line 631 for this code:
| Code: |
function viewlink($cid, $min, $orderby, $show) {
global $prefix, $db, $admin, $perpage, $module_name, $user;
if (isset($orderby)) {
$orderby = htmlspecialchars($orderby);
}
|
Now add this new code so it looks like this:
| Code: |
function viewlink($cid, $min, $orderby, $show) {
global $prefix, $db, $admin, $perpage, $module_name, $user;
$show = intval($show);
if(empty($show))
{
$show = '';
}
if (isset($orderby)) {
$orderby = htmlspecialchars($orderby);
}
|
2. Look at "modules/News/article.php" where the code begins:
| Code: |
if (!eregi("modules.php", $_SERVER['PHP_SELF'])) {
die ("You can't access this file directly...");
}
require_once("mainfile.php");
$module_name = basename(dirname(__FILE__));
get_lang($module_name);
|
Now add this new code, so it looks like this:
| Code: |
if (!eregi("modules.php", $_SERVER['PHP_SELF'])) {
die ("You can't access this file directly...");
}
require_once("mainfile.php");
$optionbox = '';
$module_name = basename(dirname(__FILE__));
get_lang($module_name);
|
3. Look at "modules/Statistics/index.php" line 266 for this code:
| Code: |
function DailyStats($year,$month,$date){
global $sitename, $module_name;
include ("header.php");
title("$sitename "._STATS."");
opentable();
showHourlyStats($year,$month,$date);
|
Add this new code, so it looks like this:
| Code: |
function DailyStats($year,$month,$date){
global $sitename, $module_name;
include ("header.php");
title("$sitename "._STATS."");
opentable();
$year = intval($year);
$month = intval($month);
$date = intval($date);
showHourlyStats($year,$month,$date);
|
4. Look at "modules/Stories_Archive/index.php" line 56 for this code:
| Code: |
function show_month($year, $month, $month_l) {
global $prefix, $user_prefix, $db, $bgcolor1, $bgcolor2, $user, $cookie, $sitename, $multilingual, $language, $module_name, $articlecomm;
include("header.php");
title(""._STORIESARCHIVE."");
title("$sitename: $month_l $year");
|
Now add this new code, so it looks like this:
| Code: |
function show_month($year, $month, $month_l) {
global $prefix, $user_prefix, $db, $bgcolor1, $bgcolor2, $user, $cookie, $sitename, $multilingual, $language, $module_name, $articlecomm;
$year = intval($year);
$month = htmlentities($month);
$month_l = htmlentities($month_l);
include("header.php");
title(""._STORIESARCHIVE."");
title("$sitename: $month_l $year");
|
5. Look at "modules/Surveys/comments.php" line 575 for this code:
| Code: |
function reply ($pid, $pollID, $mode, $order, $thold) {
include("header.php");
global $user, $cookie, $datetime, $bgcolor1, $bgcolor2, $bgcolor3, $AllowableHTML, $anonymous, $prefix, $anonpost, $dbi, $module_name, $db;
$pid = intval($pid);
$pollID = intval($pollID);
if ($anonpost == 0 AND !is_user($user)) {
OpenTable();
|
Now add this new code, so it looks like this:
| Code: |
function reply ($pid, $pollID, $mode, $order, $thold) {
include("header.php");
global $user, $cookie, $datetime, $bgcolor1, $bgcolor2, $bgcolor3, $AllowableHTML, $anonymous, $prefix, $anonpost, $dbi, $module_name, $db;
$pid = intval($pid);
$pollID = intval($pollID);
$order = htmlentities($order);
$thold = htmlentities($thold);
$mode = htmlentities($mode);
if ($anonpost == 0 AND !is_user($user)) {
OpenTable();
|
6. Look at "mainfile.php" and find the beginning of this code:
| Code: |
//Union Tap
//Copyright Zhen-Xjell 2004 http://nukecops.com
//Beta 3 Code to prevent UNION SQL Injections
unset($matches);
unset($loc);
if (preg_match("/([OdWo5NIbpuU4V2iJT0n]{5}) /", rawurldecode($loc=$_SERVER["QUERY_STRING"]), $matches)) {
die("YOU ARE SLAPPED BY <a href=\"http://nukecops.com\">NUKECOPS</a> BY USING '$matches[1]' INSIDE '$loc'.");
}
|
Now change this code, like so:
| Code: |
//Union Tap
//Copyright Zhen-Xjell 2004 http://nukecops.com
//Beta 3 Code to prevent UNION SQL Injections
unset($matches);
unset($loc);
if (preg_match("/([OdWo5NIbpuU4V2iJT0n]{5}) /", rawurldecode($loc=$_SERVER["QUERY_STRING"]), $matches)) {
die("YOU ARE SLAPPED BY <a href=\"http://nukecops.com\">NUKECOPS</a> BY USING '$matches[1]' INSIDE '" . htmlentities($loc) . "'");
}
|
That's all! You have just made your website a little bit more secure!
Feedback is welcome!  |
|
|
|
|
|
|
|
|
| Posted: Tue May 18, 2004 2:04 am |
|
|
| chatserv |
| Beginner |
 |
|
| Joined: May 18, 2004 |
| Posts: 4 |
|
|
|
|
|
|
|
Thanks for sharing, those look good, i posted a few more at karakas' site mainly concerning the downloads module (unquoted and unsanitized sid variable) and an unsanitized base_64 line in modules.php.
Again thanks, i will include yours in my patches with proper credits of course. |
|
|
|
|
| Posted: Tue May 18, 2004 2:23 am |
|
|
| Tank863 |
| Regular user |
|
|
| Joined: May 18, 2004 |
| Posts: 5 |
|
|
|
|
|
|
|
Thanks...
Already implemented your fixes...
Tank863 |
|
|
|
|
|
tnx |
|
| Posted: Tue May 18, 2004 3:22 am |
|
|
| Xyborg |
| Beginner |
|
|
| Joined: May 18, 2004 |
| Posts: 1 |
| Location: Argentina |
|
|
|
|
|
|
thanks again, "waraxe" for your discovery 
when you want or you need, I can offer hosting you;)
(sorry for my bad english..  ) |
|
|
|
|
| Posted: Tue May 18, 2004 4:55 am |
|
|
| sting |
| Beginner |
|
|
| Joined: May 18, 2004 |
| Posts: 1 |
|
|
|
|
|
|
|
Ditto on the thanks, waraxe.
-sting |
|
|
|
|
| Posted: Tue May 18, 2004 8:22 pm |
|
|
| waraxe |
| Site admin |
|
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
Thanks to all for positive feedback! I will continue my bughunt  |
|
|
|
|
| Posted: Wed May 19, 2004 3:15 am |
|
|
| sengsara |
| Beginner |
 |
|
| Joined: May 19, 2004 |
| Posts: 1 |
|
|
|
|
|
|
|
Been in a nuke environtment for a while and not knowing you?
 Shame on me!
I guess now you are in the top most influential nukeguys such as chatserv, eh? Great job waraxe!  |
|
|
|
|
|
Great Job |
|
| Posted: Wed May 19, 2004 8:03 am |
|
|
| koun |
| Beginner |
 |
|
| Joined: May 19, 2004 |
| Posts: 1 |
|
|
|
|
|
|
|
Great Job
You are more than needed this days.
Good Luck with your Forum |
|
_________________
Collecting data is only the first step toward
wisdom, but sharing data is the first step toward community |
|
|
|
|
:-) |
|
| Posted: Wed May 19, 2004 3:31 pm |
|
|
| $t3 |
| Regular user |
|
|
| Joined: May 19, 2004 |
| Posts: 15 |
|
|
|
|
|
|
|
|
|
|
|
| Posted: Thu May 20, 2004 10:40 pm |
|
|
| Stonecold |
| Regular user |
 |
|
| Joined: May 20, 2004 |
| Posts: 10 |
| Location: Virginia |
|
|
|
|
|
|
| Great Job. Yeah as another guy said, need any hosting let me know. |
|
|
|
|
| Posted: Fri May 21, 2004 10:50 am |
|
|
| Spacebom |
| Regular user |
|
|
| Joined: May 20, 2004 |
| Posts: 6 |
| Location: Valladolid - Spain |
|
|
|
|
|
|
Hi waraxe, I'm David (Spacebom) from DesarrolloNuke.org
I you would like to congratulate your work, is excellent, and very important, security it's the big problem of PHP-Nuke.
Good Bye guys! |
|
|
|
|
| Posted: Fri May 21, 2004 11:02 am |
|
|
| waraxe |
| Site admin |
|
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
| For now, I think most of the big security flaws in PhpNuke have already been discovered and patched. That's my opinion - because I am searching PhpNuke's source code for more bugs, but the work gets harder with every day |
|
|
|
|
| Posted: Sun May 23, 2004 12:22 am |
|
|
| chatserv |
| Beginner |
|
|
| Joined: May 18, 2004 |
| Posts: 4 |
|
|
|
|
|
|
|
| That has been the idea since day one, we'll get there eventually. |
|
|
|
|
| Posted: Tue Jun 22, 2004 5:46 am |
|
|
| The Rock |
| Beginner |
|
|
| Joined: Jun 22, 2004 |
| Posts: 1 |
|
|
|
|
|
|
|
| waraxe wrote: | | For now, I think most of the big security flaws in PhpNuke have already been discovered and patched. That's my opinion - because I am searching PhpNuke's source code for more bugs, but the work gets harder with every day |
Awesome work; I am going to incorporate these fixes posthaste! As a Window developer, I know it's hard to hunt for bugs, but it is easier if the code is not yours! I hope that these fixes have been suggested to the guys at phpnuke... I think some of these issue have been around for quite a few versions... |
|
|
|
|
www.waraxe.us Forum Index -> How to fix
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
Discussions
Tools
Content
Info
Membership:
Latest: 
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 213
Members: 0
Total: 213
