Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
March 29, 2024
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9145

People Online:
Visitors: 756
Members: 0
Total: 756
PacketStorm News
·301 Moved Permanently

read more...
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> How to fix -> [waraxe-2004-SA#036] [Multiple security holes in PhpNuke]
Post new topic  Reply to topic View previous topic :: View next topic 
[waraxe-2004-SA#036] [Multiple security holes in PhpNuke]
PostPosted: Sun Jul 18, 2004 5:38 pm Reply with quote
genoxide
Regular user
Regular user
 
Joined: Jun 14, 2004
Posts: 15




Ok i've tested this report on nuke 6.9 and 7.3 and heres my 2 cents Wink
Quote:
A1 - full path disclosure in "/modules/Search/index.php":

Go to search page:

http://localhost/nuke73/modules.php?name=Search

and enter to search field "**" (without double quotes).
Or enter plus sign "+".

As result there will be standard php error messages, revealing full path:

Warning: eregi(): REG_BADRPT: in D:\apache_wwwroot\nuke73\modules\Search\index.php on line 228

Warning: eregi(): REG_BADRPT: in D:\apache_wwwroot\nuke73\modules\Search\index.php on line 232

Warning: eregi(): REG_BADRPT: in D:\apache_wwwroot\nuke73\modules\Search\index.php on line 235


Don't get any off those errors, maybe my php.ini? Rolling Eyes

Quote:
B - Cross-site scripting aka XSS
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

B1 - xss in "/modules/Search/index.php" through user submitted variable "$sid":

http://localhost/nuke73/modules.php?name=Search&sid=[xss code here]

$sid = intval($_POST['sid']);

Quote:
B2 - xss in "/modules/Search/index.php" through user submitted variable "$max":

http://localhost/nuke73/modules.php?name=Search&query=*&max=[xss code here]

remark: search results count must be >= 9.


$max = intval($_POST['max']);

Quote:
B3 - xss in "/modules/Search/index.php" through uninitialized variables "$sel1" - "sel5":

http://localhost/nuke73/modules.php?name=Search&query=waraxe&sel1=[xss code here]&type=comments


$sel1 = '';
$sel2 = '';
$sel3 = '';
$sel4 = '';
$sel5 = '';

Quote:
B4 - xss in "/modules/Search/index.php" through uninitialized variable "$match":

http://localhost/nuke73/modules.php?name=Search&a=6&query=*&match=[xss code here]


$match = '';

Quote:
B5 - xss in "/modules/Search/index.php" through uninitialized variables "$mod1" - "$mod3":

http://www.nukecops.com/modules.php?name=Search&query=*&mod3=[xss code here]

Remark - specific module must be disabled in order to xss triggering!


$mod1 = '';
$mod2 = '';
$mod3 = '';

Quote:
C - Sql Injection
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

C1 - noncritical sql injection case in "/modules/Search/index.php":

Reason is unsanitized user-submitted variable "$min", which gets delievered directly
to sql request, afrer "ORDER BY / LIMIT" keywords. In mysql version 4.0 its not useful for exploiting,
but in case of new version 4.1, where subselects functionality will be available, there will be
possibility to use blind sql injection methods. So - this security bug must be fixed ASAP.

C2 - critical sql injection case in "/modules/Search/index.php":

Yeah, yeah, yeah - AGAIIIIIN! Fatal sql injection...

"Use the Source, Luke" --> let's look @ original code

----------------[ original source ]-----------------

$query = addslashes($query);

if ($type=="stories" OR !$type)
{
if ($category > 0)
{
$categ = "AND catid='$category' ";
}
elseif ($category == 0)
{
$categ = "";
}

$q = "select s.sid, s.aid, s.informant, s.title, s.time, s.hometext, s.bodytext,
a.url, s.comments, s.topic from ".$prefix."_stories s, ".$prefix."_authors a
where s.aid=a.aid $queryalang $categ";
if (isset($query)) $q .= "AND (s.title LIKE '%$query%' OR s.hometext LIKE '%$query%'
OR s.bodytext LIKE '%$query%' OR s.notes LIKE '%$query%') ";
if ($author != "") $q .= "AND s.aid='$author' ";
if ($topic != "") $q .= "AND s.topic='$topic' ";
if ($days != "" && $days!=0) $q .= "AND TO_DAYS(NOW()) - TO_DAYS(time) <= '$days' ";
$q .= " ORDER BY s.time DESC LIMIT $min,$offset";
$t = $topic;

$result5 = $db->sql_query($q);

----------------[/original source ]-----------------

What we can see here, is that construction "if/elseif" misses ending part "/else".
And if we deliver there "$category" as < 0, then variable "$categ" will be uninitialized.

So - let's get dirty Wink

----------------[ real life exploit ]---------------

http://localhost/nuke73/modules.php?name=Search&type=stories&query=f00bar&category=-1
&categ=%20and%201=2%20UNION%20SELECT%200,0,aid,pwd,0,0,0,0,0,0%20from%20nuke_authors/*


there are 2 ways of doing this

#1 by making $categ = intval($categ);
#2 changing the code to:
Code:
if ($type=="stories" OR !$type)
{
    if ($category > 0)
    {
        $categ = "AND catid='$category' ";
    }
    elseif ($category == 0)
    {
        $categ = "";
    } else {
 $categ = "";
}

 

cheers Wink
View user's profile Send private message
PostPosted: Thu Aug 05, 2004 2:05 am Reply with quote
chatserv
Beginner
Beginner
 
Joined: May 18, 2004
Posts: 4




For the last one this should be enough:
Code:
if ($type=="stories" OR !$type)
{
    if ($category > 0)
    {
        $categ = "AND catid='$category' ";
    } else {
 $categ = "";
}

Originally the string checks if $category is greater than 0 give $categ a value else if $category equals 0 make $categ blank else make $categ blank, with the modified string it now reads if $category is greater than 0 give $categ a value else for all other conditions make $categ blank, one less check, same results.
View user's profile Send private message Visit poster's website
PostPosted: Thu Aug 05, 2004 2:11 am Reply with quote
chatserv
Beginner
Beginner
 
Joined: May 18, 2004
Posts: 4




On that note the module has another vulnerability where a variable that was left wide open is being exploited: $instory, consider the following block of code:
Code:
   } elseif ($type=="comments") {
/*
                $sid = intval($sid);
       if (isset($sid)) {
      $row7 = $db->sql_fetchrow($db->sql_query("SELECT title from ".$prefix."_stories where sid='$sid'"));
      $st_title = $row7['title'];
      $instory = "AND sid='$sid'";
       } else {
      $instory = "";
       }
*/
            $result8 = $db->sql_query("SELECT tid, sid, subject, date, name from ".$prefix."_comments where (subject like '%$query%' OR comment like '%$query%') $instory order by date DESC limit $min,$offset");

$instory gets used in the query but the block of code in which it gets set was commented out, hence no actual value gets defined for it nor is it validated, removing $instory from the query should take care of that one.
View user's profile Send private message Visit poster's website
[waraxe-2004-SA#036] [Multiple security holes in PhpNuke]
  www.waraxe.us Forum Index -> How to fix
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Post new topic  Reply to topic  




Powered by phpBB © 2001-2008 phpBB Group






Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2020 Janek Vind "waraxe"
Page Generation: 0.122 Seconds