Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
March 20, 2018
 Members List
 IRC chat
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 Sql Char Encoder
 y3dips ITsec
 Md5 Cracker
 User Manuals
 Recommend Us
 Your Account

User Info
Welcome, Anonymous

Latest: Rloaded1
New Today: 0
New Yesterday: 0
Overall: 9144

People Online:
Visitors: 444
Members: 0
Total: 444
PacketStorm News
Currently there is a problem with headlines from this site
[waraxe-2004-SA#035] - Multiple security holes in PhpNuke - part 2

Author: Janek Vind "waraxe"
Date: 17. July 2004
Location: Estonia, Tartu
Web: http://www.waraxe.us/index.php?modname=sa&id=35

Affected software description:

Php-Nuke is a popular freeware content management system, written in php by
Francisco Burzi. This CMS (Content Management System) is used on many thousands
websites, because it's freeware, easy to install and has broad set of features.

Homepage: http://phpnuke.org


This time we will look @ security holes - 1 XSS and 1 sql inject case -
in "Search" module.

A - Cross-site scripting aka XSS

A1 - xss in "/modules/Search/index.php":

Open search page in phpnuke:


and enter to input field something like this:

1"><body onload="alert(document.cookie);

In case of other browsers than IE xss exploiting method can be modified, but one thing
is sure - xss case exists here...

B - Sql Injection

B1 - critical sql injection case in "/modules/Search/index.php":

Well, let's look at source code from that script:

----------------[ original source ]-----------------
} elseif ($type == "comments" AND isset($sid)) {
$res = $db->sql_query("select title from ".$prefix."_stories where sid='$sid'");
list($st_title) = $db->sql_fetchrow($res);
$instory = "AND sid='$sid'";
echo "<center><font class="title"><b>"._SEARCHINSTORY." $st_title</b></font></center><br>";
} else {
echo "<center><font class="title"><b>"._SEARCHIN." $topictext</b></font></center><br>";
----------------[/original source ]-----------------

So - if search type is "comments" and there is no "sid" specified, then sql query
fragment "instory" is not initialized. Now, let's look further:

----------------[ original source ]-----------------
} elseif ($type=="comments") {
$result8 = $db->sql_query("SELECT tid, sid, subject, date, name from
".$prefix."_comments where (subject like '%$query%' OR comment like '%$query%')
$instory order by date DESC limit $min,$offset");
----------------[/original source ]-----------------

What is here, is a typical case of uninitialized variable - "instory".
It's time to turn this little bug to something evil:

----------------[ real life exploit ]---------------


----------------[/real life exploit ]---------------

... and we see all the secret information about admins :)

Have a nice day!

How to fix:

Fixing tutorials, discussion, help - look at http://www.waraxe.us/forums.html

See ya there!


Greets to Raido Kerna and to http://www.gamecheaters.us staff!
Special greets to icenix and slimjim100!
Tervitused - Heintz ja Maku!


Janek Vind "waraxe"

Homepage: http://www.waraxe.us/

---------------------------------- [ EOF ] ------------------------------------

Copyright © by Waraxe IT Security Portal All Right Reserved.

Published on: 2005-01-06 (19548 reads)

[ Go Back ]
Top members by posts
waraxe  waraxe - 2407
vince213333  vince213333 - 737
pexli  pexli - 665
Mullog  Mullog - 539
demon  demon - 485
shai-tan  shai-tan - 477
Cyko  Cyko - 375
tsabitah  tsabitah - 328
y3dips  y3dips - 281
·Vuln: Oracle Java SE CVE-2015-4860 Remote Security Vulnerability
·Vuln: Oracle Java SE CVE-2015-4872 Remote Security Vulnerability
·Vuln: Oracle Java SE CVE-2015-4911 Remote Security Vulnerability
·Vuln: Oracle Java SE CVE-2015-4903 Remote Security Vulnerability
·Bugtraq: [SECURITY] [DSA 3413-1] openssl security update
·Bugtraq: [SECURITY] [DSA 3412-1] redis security update
·Bugtraq: [security bulletin] HPSBGN03525 rev.1: HP Performance Center Virtual Table Server, Remote Code Execution
·Bugtraq: ESA-2015-171 EMC NetWorker Denial-of-service Vulnerability
·More rss feeds from SecurityFocus


Hard drive recovery - Game Cheats - Book Reviews - Cisco VPN error 412
Harry Potter - Book Reviews - Old Science Books Online - Biographies Online Database
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2013 Janek Vind "waraxe"
Page Generation: 0.081 Seconds