Waraxe IT Security Portal
Login or Register
July 14, 2024
Menu
Home
Logout
Discussions
Forums
Members List
IRC chat
Tools
Base64 coder
MD5 hash
CRC32 checksum
ROT13 coder
SHA-1 hash
URL-decoder
Sql Char Encoder
Affiliates
y3dips ITsec
Md5 Cracker
User Manuals
AlbumNow
Content
Content
Sections
FAQ
Top
Info
Feedback
Recommend Us
Search
Journal
Your Account
User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9144

People Online:
Visitors: 187
Members: 0
Total: 187
Full disclosure
CVE-2024-33326
CVE-2024-33327
CVE-2024-33328
CVE-2024-33329
CyberDanube Security Research 20240703-0 | Authenticated Command Injection in Helmholz Industrial Router REX100
SEC Consult SA-20240627-0 :: Local Privilege Escalation via MSI installer in SoftMaker Office / FreeOffice
SEC Consult SA-20240626-0 :: Multiple Vulnerabilities in Siemens Power Automation Products
Novel DoS Vulnerability Affecting WebRTC Media Servers
APPLE-SA-06-25-2024-1 AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Beats Firmware Update 6F8
40 vulnerabilities in Toshiba Multi-Function Printers
17 vulnerabilities in Sharp Multi-Function Printers
SEC Consult SA-20240624-0 :: Multiple Vulnerabilities allowing complete bypass in Faronics WINSelect (Standard + Enterprise)
SEC Consult SA-20240620-0 :: Arbitrary File Upload in edu-sharing (metaVentis GmbH)
Zip Slip meets Artifactory: A Bug Bounty Story
Backdoor.Win32.Plugx / Insecure Permissions
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> How to fix -> [waraxe-2004-SA#036] [Multiple security holes in PhpNuke]
Post new topicReply to topic View previous topic :: View next topic
[waraxe-2004-SA#036] [Multiple security holes in PhpNuke]
PostPosted: Sun Jul 18, 2004 5:38 pm Reply with quote
genoxide
Regular user
Regular user
Joined: Jun 14, 2004
Posts: 15




Ok i've tested this report on nuke 6.9 and 7.3 and heres my 2 cents Wink
Quote:
A1 - full path disclosure in "/modules/Search/index.php":

Go to search page:

http://localhost/nuke73/modules.php?name=Search

and enter to search field "**" (without double quotes).
Or enter plus sign "+".

As result there will be standard php error messages, revealing full path:

Warning: eregi(): REG_BADRPT: in D:\apache_wwwroot\nuke73\modules\Search\index.php on line 228

Warning: eregi(): REG_BADRPT: in D:\apache_wwwroot\nuke73\modules\Search\index.php on line 232

Warning: eregi(): REG_BADRPT: in D:\apache_wwwroot\nuke73\modules\Search\index.php on line 235


Don't get any off those errors, maybe my php.ini? Rolling Eyes

Quote:
B - Cross-site scripting aka XSS
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

B1 - xss in "/modules/Search/index.php" through user submitted variable "$sid":

http://localhost/nuke73/modules.php?name=Search&sid=[xss code here]

$sid = intval($_POST['sid']);

Quote:
B2 - xss in "/modules/Search/index.php" through user submitted variable "$max":

http://localhost/nuke73/modules.php?name=Search&query=*&max=[xss code here]

remark: search results count must be >= 9.


$max = intval($_POST['max']);

Quote:
B3 - xss in "/modules/Search/index.php" through uninitialized variables "$sel1" - "sel5":

http://localhost/nuke73/modules.php?name=Search&query=waraxe&sel1=[xss code here]&type=comments


$sel1 = '';
$sel2 = '';
$sel3 = '';
$sel4 = '';
$sel5 = '';

Quote:
B4 - xss in "/modules/Search/index.php" through uninitialized variable "$match":

http://localhost/nuke73/modules.php?name=Search&a=6&query=*&match=[xss code here]


$match = '';

Quote:
B5 - xss in "/modules/Search/index.php" through uninitialized variables "$mod1" - "$mod3":

http://www.nukecops.com/modules.php?name=Search&query=*&mod3=[xss code here]

Remark - specific module must be disabled in order to xss triggering!


$mod1 = '';
$mod2 = '';
$mod3 = '';

Quote:
C - Sql Injection
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

C1 - noncritical sql injection case in "/modules/Search/index.php":

Reason is unsanitized user-submitted variable "$min", which gets delievered directly
to sql request, afrer "ORDER BY / LIMIT" keywords. In mysql version 4.0 its not useful for exploiting,
but in case of new version 4.1, where subselects functionality will be available, there will be
possibility to use blind sql injection methods. So - this security bug must be fixed ASAP.

C2 - critical sql injection case in "/modules/Search/index.php":

Yeah, yeah, yeah - AGAIIIIIN! Fatal sql injection...

"Use the Source, Luke" --> let's look @ original code

----------------[ original source ]-----------------

$query = addslashes($query);

if ($type=="stories" OR !$type)
{
if ($category > 0)
{
$categ = "AND catid='$category' ";
}
elseif ($category == 0)
{
$categ = "";
}

$q = "select s.sid, s.aid, s.informant, s.title, s.time, s.hometext, s.bodytext,
a.url, s.comments, s.topic from ".$prefix."_stories s, ".$prefix."_authors a
where s.aid=a.aid $queryalang $categ";
if (isset($query)) $q .= "AND (s.title LIKE '%$query%' OR s.hometext LIKE '%$query%'
OR s.bodytext LIKE '%$query%' OR s.notes LIKE '%$query%') ";
if ($author != "") $q .= "AND s.aid='$author' ";
if ($topic != "") $q .= "AND s.topic='$topic' ";
if ($days != "" && $days!=0) $q .= "AND TO_DAYS(NOW()) - TO_DAYS(time) <= '$days' ";
$q .= " ORDER BY s.time DESC LIMIT $min,$offset";
$t = $topic;

$result5 = $db->sql_query($q);

----------------[/original source ]-----------------

What we can see here, is that construction "if/elseif" misses ending part "/else".
And if we deliver there "$category" as < 0, then variable "$categ" will be uninitialized.

So - let's get dirty Wink

----------------[ real life exploit ]---------------

http://localhost/nuke73/modules.php?name=Search&type=stories&query=f00bar&category=-1
&categ=%20and%201=2%20UNION%20SELECT%200,0,aid,pwd,0,0,0,0,0,0%20from%20nuke_authors/*


there are 2 ways of doing this

#1 by making $categ = intval($categ);
#2 changing the code to:
Code:
if ($type=="stories" OR !$type)
{
if ($category > 0)
{
$categ = "AND catid='$category' ";
}
elseif ($category == 0)
{
$categ = "";
} else {
$categ = "";
}


cheers Wink
View user's profile Send private message
PostPosted: Thu Aug 05, 2004 2:05 am Reply with quote
chatserv
Beginner
Beginner
Joined: May 18, 2004
Posts: 4




For the last one this should be enough:
Code:
if ($type=="stories" OR !$type)
{
if ($category > 0)
{
$categ = "AND catid='$category' ";
} else {
$categ = "";
}

Originally the string checks if $category is greater than 0 give $categ a value else if $category equals 0 make $categ blank else make $categ blank, with the modified string it now reads if $category is greater than 0 give $categ a value else for all other conditions make $categ blank, one less check, same results.
View user's profile Send private message Visit poster's website
PostPosted: Thu Aug 05, 2004 2:11 am Reply with quote
chatserv
Beginner
Beginner
Joined: May 18, 2004
Posts: 4




On that note the module has another vulnerability where a variable that was left wide open is being exploited: $instory, consider the following block of code:
Code:
} elseif ($type=="comments") {
/*
$sid = intval($sid);
if (isset($sid)) {
$row7 = $db->sql_fetchrow($db->sql_query("SELECT title from ".$prefix."_stories where sid='$sid'"));
$st_title = $row7['title'];
$instory = "AND sid='$sid'";
} else {
$instory = "";
}
*/
$result8 = $db->sql_query("SELECT tid, sid, subject, date, name from ".$prefix."_comments where (subject like '%$query%' OR comment like '%$query%') $instory order by date DESC limit $min,$offset");

$instory gets used in the query but the block of code in which it gets set was commented out, hence no actual value gets defined for it nor is it validated, removing $instory from the query should take care of that one.
View user's profile Send private message Visit poster's website
[waraxe-2004-SA#036] [Multiple security holes in PhpNuke]
www.waraxe.us Forum Index -> How to fix
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT
Page 1 of 1

Post new topicReply to topic


Powered by phpBB 2001-2008 phpBB Group



Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.123 Seconds