Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
March 29, 2024
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9145

People Online:
Visitors: 718
Members: 0
Total: 718
PacketStorm News
·301 Moved Permanently

read more...
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> How to fix -> [waraxe-2004-SA#030] - Multiple vulnerabilities in PhpNuke
Post new topic  Reply to topic View previous topic :: View next topic 
[waraxe-2004-SA#030] - Multiple vulnerabilities in PhpNuke
PostPosted: Mon May 17, 2004 6:09 pm Reply with quote
waraxe
Site admin
Site admin
 
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




Here are my patches for PhpNuke 7.3 version, but they will apply with possible minor changes, to older versions too. If you have problems with the patches, or wanna suggest better solutions, or have additional questions - post them here and discuss it with other members.

1. Look at "modules/Web_Links/index.php" line 631 for this code:

Code:

function viewlink($cid, $min, $orderby, $show) {
    global $prefix, $db, $admin, $perpage, $module_name, $user;
    if (isset($orderby)) {
    $orderby = htmlspecialchars($orderby);
    }


Now add this new code so it looks like this:

Code:

function viewlink($cid, $min, $orderby, $show) {
    global $prefix, $db, $admin, $perpage, $module_name, $user;
   
    $show = intval($show);
    if(empty($show))
    {
        $show = '';
    }
   
    if (isset($orderby)) {
    $orderby = htmlspecialchars($orderby);
    }


2. Look at "modules/News/article.php" where the code begins:

Code:

if (!eregi("modules.php", $_SERVER['PHP_SELF'])) {
    die ("You can't access this file directly...");
}
require_once("mainfile.php");
$module_name = basename(dirname(__FILE__));
get_lang($module_name);


Now add this new code, so it looks like this:

Code:

if (!eregi("modules.php", $_SERVER['PHP_SELF'])) {
    die ("You can't access this file directly...");
}
require_once("mainfile.php");
$optionbox = '';
$module_name = basename(dirname(__FILE__));
get_lang($module_name);


3. Look at "modules/Statistics/index.php" line 266 for this code:

Code:

function DailyStats($year,$month,$date){
    global $sitename, $module_name;
    include ("header.php");
    title("$sitename "._STATS."");
    opentable();
    showHourlyStats($year,$month,$date);


Add this new code, so it looks like this:

Code:

function DailyStats($year,$month,$date){
    global $sitename, $module_name;
    include ("header.php");
    title("$sitename "._STATS."");
    opentable();
   
    $year = intval($year);
    $month = intval($month);
    $date = intval($date);
   
    showHourlyStats($year,$month,$date);


4. Look at "modules/Stories_Archive/index.php" line 56 for this code:

Code:

function show_month($year, $month, $month_l) {
    global $prefix, $user_prefix, $db, $bgcolor1, $bgcolor2, $user, $cookie, $sitename, $multilingual, $language, $module_name, $articlecomm;
    include("header.php");
    title(""._STORIESARCHIVE."");
    title("$sitename: $month_l $year");


Now add this new code, so it looks like this:

Code:

function show_month($year, $month, $month_l) {
    global $prefix, $user_prefix, $db, $bgcolor1, $bgcolor2, $user, $cookie, $sitename, $multilingual, $language, $module_name, $articlecomm;
   
    $year = intval($year);
    $month = htmlentities($month);
    $month_l = htmlentities($month_l);
   
    include("header.php");
    title(""._STORIESARCHIVE."");
    title("$sitename: $month_l $year");


5. Look at "modules/Surveys/comments.php" line 575 for this code:

Code:

function reply ($pid, $pollID, $mode, $order, $thold) {
    include("header.php");
    global $user, $cookie, $datetime, $bgcolor1, $bgcolor2, $bgcolor3, $AllowableHTML, $anonymous, $prefix, $anonpost, $dbi, $module_name, $db;
    $pid = intval($pid);
    $pollID = intval($pollID);
    if ($anonpost == 0 AND !is_user($user)) {
        OpenTable();


Now add this new code, so it looks like this:

Code:

function reply ($pid, $pollID, $mode, $order, $thold) {
    include("header.php");
    global $user, $cookie, $datetime, $bgcolor1, $bgcolor2, $bgcolor3, $AllowableHTML, $anonymous, $prefix, $anonpost, $dbi, $module_name, $db;
    $pid = intval($pid);
    $pollID = intval($pollID);
   
    $order = htmlentities($order);
    $thold = htmlentities($thold);
    $mode = htmlentities($mode);
   
    if ($anonpost == 0 AND !is_user($user)) {
        OpenTable();


6. Look at "mainfile.php" and find the beginning of this code:

Code:

//Union Tap
//Copyright Zhen-Xjell 2004 http://nukecops.com
//Beta 3 Code to prevent UNION SQL Injections
unset($matches);
unset($loc);
if (preg_match("/([OdWo5NIbpuU4V2iJT0n]{5}) /", rawurldecode($loc=$_SERVER["QUERY_STRING"]), $matches)) {
   die("YOU ARE SLAPPED BY <a href=\"http://nukecops.com\">NUKECOPS</a> BY USING '$matches[1]' INSIDE '$loc'.");
}


Now change this code, like so:

Code:

//Union Tap
//Copyright Zhen-Xjell 2004 http://nukecops.com
//Beta 3 Code to prevent UNION SQL Injections
unset($matches);
unset($loc);
if (preg_match("/([OdWo5NIbpuU4V2iJT0n]{5}) /", rawurldecode($loc=$_SERVER["QUERY_STRING"]), $matches)) {
   die("YOU ARE SLAPPED BY <a href=\"http://nukecops.com\">NUKECOPS</a> BY USING '$matches[1]' INSIDE '" . htmlentities($loc) . "'");
}


That's all! You have just made your website a little bit more secure!
Feedback is welcome! Cool
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Tue May 18, 2004 2:04 am Reply with quote
chatserv
Beginner
Beginner
 
Joined: May 18, 2004
Posts: 4




Thanks for sharing, those look good, i posted a few more at karakas' site mainly concerning the downloads module (unquoted and unsanitized sid variable) and an unsanitized base_64 line in modules.php.

Again thanks, i will include yours in my patches with proper credits of course.
View user's profile Send private message Visit poster's website
PostPosted: Tue May 18, 2004 2:23 am Reply with quote
Tank863
Regular user
Regular user
 
Joined: May 18, 2004
Posts: 5




Thanks...

Already implemented your fixes...

Tank863
View user's profile Send private message
tnx
PostPosted: Tue May 18, 2004 3:22 am Reply with quote
Xyborg
Beginner
Beginner
 
Joined: May 18, 2004
Posts: 1
Location: Argentina




thanks again, "waraxe" for your discovery Smile

when you want or you need, I can offer hosting you;)

(sorry for my bad english.. Embarassed )

_________________
XyborG
Rynho Zeros Web
http://www.rzw.com.ar
View user's profile Send private message Visit poster's website Yahoo Messenger MSN Messenger ICQ Number
PostPosted: Tue May 18, 2004 4:55 am Reply with quote
sting
Beginner
Beginner
 
Joined: May 18, 2004
Posts: 1




Ditto on the thanks, waraxe.

-sting
View user's profile Send private message
PostPosted: Tue May 18, 2004 8:22 pm Reply with quote
waraxe
Site admin
Site admin
 
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




Thanks to all for positive feedback! I will continue my bughunt Wink
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Wed May 19, 2004 3:15 am Reply with quote
sengsara
Beginner
Beginner
 
Joined: May 19, 2004
Posts: 1




Been in a nuke environtment for a while and not knowing you?
Evil or Very Mad Shame on me!

I guess now you are in the top most influential nukeguys such as chatserv, eh? Great job waraxe! Very Happy
View user's profile Send private message
Great Job
PostPosted: Wed May 19, 2004 8:03 am Reply with quote
koun
Beginner
Beginner
 
Joined: May 19, 2004
Posts: 1




Great Job
You are more than needed this days.
Good Luck with your Forum

_________________
Collecting data is only the first step toward
wisdom, but sharing data is the first step toward community
View user's profile Send private message
:-)
PostPosted: Wed May 19, 2004 3:31 pm Reply with quote
$t3
Regular user
Regular user
 
Joined: May 19, 2004
Posts: 15




thanx waraxe!
View user's profile Send private message
PostPosted: Thu May 20, 2004 10:40 pm Reply with quote
Stonecold
Regular user
Regular user
 
Joined: May 20, 2004
Posts: 10
Location: Virginia




Great Job. Yeah as another guy said, need any hosting let me know.
View user's profile Send private message Yahoo Messenger MSN Messenger
PostPosted: Fri May 21, 2004 10:50 am Reply with quote
Spacebom
Regular user
Regular user
 
Joined: May 20, 2004
Posts: 6
Location: Valladolid - Spain




Hi waraxe, I'm David (Spacebom) from DesarrolloNuke.org

I you would like to congratulate your work, is excellent, and very important, security it's the big problem of PHP-Nuke.

Good Bye guys! Wink
View user's profile Send private message Visit poster's website
PostPosted: Fri May 21, 2004 11:02 am Reply with quote
waraxe
Site admin
Site admin
 
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




For now, I think most of the big security flaws in PhpNuke have already been discovered and patched. That's my opinion - because I am searching PhpNuke's source code for more bugs, but the work gets harder with every day Wink
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Sun May 23, 2004 12:22 am Reply with quote
chatserv
Beginner
Beginner
 
Joined: May 18, 2004
Posts: 4




That has been the idea since day one, we'll get there eventually.
View user's profile Send private message Visit poster's website
PostPosted: Tue Jun 22, 2004 5:46 am Reply with quote
The Rock
Beginner
Beginner
 
Joined: Jun 22, 2004
Posts: 1




waraxe wrote:
For now, I think most of the big security flaws in PhpNuke have already been discovered and patched. That's my opinion - because I am searching PhpNuke's source code for more bugs, but the work gets harder with every day Wink


Awesome work; I am going to incorporate these fixes posthaste! As a Window developer, I know it's hard to hunt for bugs, but it is easier if the code is not yours! Wink I hope that these fixes have been suggested to the guys at phpnuke... I think some of these issue have been around for quite a few versions...
View user's profile Send private message Visit poster's website
[waraxe-2004-SA#030] - Multiple vulnerabilities in PhpNuke
  www.waraxe.us Forum Index -> How to fix
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Post new topic  Reply to topic  




Powered by phpBB © 2001-2008 phpBB Group






Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2020 Janek Vind "waraxe"
Page Generation: 0.181 Seconds