Waraxe IT Security Portal
Login or Register
July 18, 2024
Menu
Home
Logout
Discussions
Forums
Members List
IRC chat
Tools
Base64 coder
MD5 hash
CRC32 checksum
ROT13 coder
SHA-1 hash
URL-decoder
Sql Char Encoder
Affiliates
y3dips ITsec
Md5 Cracker
User Manuals
AlbumNow
Content
Content
Sections
FAQ
Top
Info
Feedback
Recommend Us
Search
Journal
Your Account
User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9144

People Online:
Visitors: 210
Members: 0
Total: 210
Full disclosure
[KIS-2024-06] XenForo <= 2.2.15 (Template System) Remote Code Execution Vulnerability
[KIS-2024-05] XenForo <= 2.2.15 (Widget::actionSave) Cross-Site Request Forgery Vulnerability
CVE-2024-33326
CVE-2024-33327
CVE-2024-33328
CVE-2024-33329
CyberDanube Security Research 20240703-0 | Authenticated Command Injection in Helmholz Industrial Router REX100
SEC Consult SA-20240627-0 :: Local Privilege Escalation via MSI installer in SoftMaker Office / FreeOffice
SEC Consult SA-20240626-0 :: Multiple Vulnerabilities in Siemens Power Automation Products
Novel DoS Vulnerability Affecting WebRTC Media Servers
APPLE-SA-06-25-2024-1 AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Beats Firmware Update 6F8
40 vulnerabilities in Toshiba Multi-Function Printers
17 vulnerabilities in Sharp Multi-Function Printers
SEC Consult SA-20240624-0 :: Multiple Vulnerabilities allowing complete bypass in Faronics WINSelect (Standard + Enterprise)
SEC Consult SA-20240620-0 :: Arbitrary File Upload in edu-sharing (metaVentis GmbH)
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> How to fix -> [waraxe-2004-SA#030] - Multiple vulnerabilities in PhpNuke
Post new topicReply to topic View previous topic :: View next topic
[waraxe-2004-SA#030] - Multiple vulnerabilities in PhpNuke
PostPosted: Mon May 17, 2004 6:09 pm Reply with quote
waraxe
Site admin
Site admin
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




Here are my patches for PhpNuke 7.3 version, but they will apply with possible minor changes, to older versions too. If you have problems with the patches, or wanna suggest better solutions, or have additional questions - post them here and discuss it with other members.

1. Look at "modules/Web_Links/index.php" line 631 for this code:

Code:

function viewlink($cid, $min, $orderby, $show) {
global $prefix, $db, $admin, $perpage, $module_name, $user;
if (isset($orderby)) {
$orderby = htmlspecialchars($orderby);
}


Now add this new code so it looks like this:

Code:

function viewlink($cid, $min, $orderby, $show) {
global $prefix, $db, $admin, $perpage, $module_name, $user;

$show = intval($show);
if(empty($show))
{
$show = '';
}

if (isset($orderby)) {
$orderby = htmlspecialchars($orderby);
}


2. Look at "modules/News/article.php" where the code begins:

Code:

if (!eregi("modules.php", $_SERVER['PHP_SELF'])) {
die ("You can't access this file directly...");
}
require_once("mainfile.php");
$module_name = basename(dirname(__FILE__));
get_lang($module_name);


Now add this new code, so it looks like this:

Code:

if (!eregi("modules.php", $_SERVER['PHP_SELF'])) {
die ("You can't access this file directly...");
}
require_once("mainfile.php");
$optionbox = '';
$module_name = basename(dirname(__FILE__));
get_lang($module_name);


3. Look at "modules/Statistics/index.php" line 266 for this code:

Code:

function DailyStats($year,$month,$date){
global $sitename, $module_name;
include ("header.php");
title("$sitename "._STATS."");
opentable();
showHourlyStats($year,$month,$date);


Add this new code, so it looks like this:

Code:

function DailyStats($year,$month,$date){
global $sitename, $module_name;
include ("header.php");
title("$sitename "._STATS."");
opentable();

$year = intval($year);
$month = intval($month);
$date = intval($date);

showHourlyStats($year,$month,$date);


4. Look at "modules/Stories_Archive/index.php" line 56 for this code:

Code:

function show_month($year, $month, $month_l) {
global $prefix, $user_prefix, $db, $bgcolor1, $bgcolor2, $user, $cookie, $sitename, $multilingual, $language, $module_name, $articlecomm;
include("header.php");
title(""._STORIESARCHIVE."");
title("$sitename: $month_l $year");


Now add this new code, so it looks like this:

Code:

function show_month($year, $month, $month_l) {
global $prefix, $user_prefix, $db, $bgcolor1, $bgcolor2, $user, $cookie, $sitename, $multilingual, $language, $module_name, $articlecomm;

$year = intval($year);
$month = htmlentities($month);
$month_l = htmlentities($month_l);

include("header.php");
title(""._STORIESARCHIVE."");
title("$sitename: $month_l $year");


5. Look at "modules/Surveys/comments.php" line 575 for this code:

Code:

function reply ($pid, $pollID, $mode, $order, $thold) {
include("header.php");
global $user, $cookie, $datetime, $bgcolor1, $bgcolor2, $bgcolor3, $AllowableHTML, $anonymous, $prefix, $anonpost, $dbi, $module_name, $db;
$pid = intval($pid);
$pollID = intval($pollID);
if ($anonpost == 0 AND !is_user($user)) {
OpenTable();


Now add this new code, so it looks like this:

Code:

function reply ($pid, $pollID, $mode, $order, $thold) {
include("header.php");
global $user, $cookie, $datetime, $bgcolor1, $bgcolor2, $bgcolor3, $AllowableHTML, $anonymous, $prefix, $anonpost, $dbi, $module_name, $db;
$pid = intval($pid);
$pollID = intval($pollID);

$order = htmlentities($order);
$thold = htmlentities($thold);
$mode = htmlentities($mode);

if ($anonpost == 0 AND !is_user($user)) {
OpenTable();


6. Look at "mainfile.php" and find the beginning of this code:

Code:

//Union Tap
//Copyright Zhen-Xjell 2004 http://nukecops.com
//Beta 3 Code to prevent UNION SQL Injections
unset($matches);
unset($loc);
if (preg_match("/([OdWo5NIbpuU4V2iJT0n]{5}) /", rawurldecode($loc=$_SERVER["QUERY_STRING"]), $matches)) {
die("YOU ARE SLAPPED BY <a href=\"http://nukecops.com\">NUKECOPS</a> BY USING '$matches[1]' INSIDE '$loc'.");
}


Now change this code, like so:

Code:

//Union Tap
//Copyright Zhen-Xjell 2004 http://nukecops.com
//Beta 3 Code to prevent UNION SQL Injections
unset($matches);
unset($loc);
if (preg_match("/([OdWo5NIbpuU4V2iJT0n]{5}) /", rawurldecode($loc=$_SERVER["QUERY_STRING"]), $matches)) {
die("YOU ARE SLAPPED BY <a href=\"http://nukecops.com\">NUKECOPS</a> BY USING '$matches[1]' INSIDE '" . htmlentities($loc) . "'");
}


That's all! You have just made your website a little bit more secure!
Feedback is welcome! Cool
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Tue May 18, 2004 2:04 am Reply with quote
chatserv
Beginner
Beginner
Joined: May 18, 2004
Posts: 4




Thanks for sharing, those look good, i posted a few more at karakas' site mainly concerning the downloads module (unquoted and unsanitized sid variable) and an unsanitized base_64 line in modules.php.

Again thanks, i will include yours in my patches with proper credits of course.
View user's profile Send private message Visit poster's website
PostPosted: Tue May 18, 2004 2:23 am Reply with quote
Tank863
Regular user
Regular user
Joined: May 18, 2004
Posts: 5




Thanks...

Already implemented your fixes...

Tank863
View user's profile Send private message
tnx
PostPosted: Tue May 18, 2004 3:22 am Reply with quote
Xyborg
Beginner
Beginner
Joined: May 18, 2004
Posts: 1
Location: Argentina




thanks again, "waraxe" for your discovery Smile

when you want or you need, I can offer hosting you;)

(sorry for my bad english.. Embarassed )

_________________
XyborG
Rynho Zeros Web
http://www.rzw.com.ar
View user's profile Send private message Visit poster's website Yahoo Messenger MSN Messenger ICQ Number
PostPosted: Tue May 18, 2004 4:55 am Reply with quote
sting
Beginner
Beginner
Joined: May 18, 2004
Posts: 1




Ditto on the thanks, waraxe.

-sting
View user's profile Send private message
PostPosted: Tue May 18, 2004 8:22 pm Reply with quote
waraxe
Site admin
Site admin
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




Thanks to all for positive feedback! I will continue my bughunt Wink
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Wed May 19, 2004 3:15 am Reply with quote
sengsara
Beginner
Beginner
Joined: May 19, 2004
Posts: 1




Been in a nuke environtment for a while and not knowing you?
Evil or Very Mad Shame on me!

I guess now you are in the top most influential nukeguys such as chatserv, eh? Great job waraxe! Very Happy
View user's profile Send private message
Great Job
PostPosted: Wed May 19, 2004 8:03 am Reply with quote
koun
Beginner
Beginner
Joined: May 19, 2004
Posts: 1




Great Job
You are more than needed this days.
Good Luck with your Forum

_________________
Collecting data is only the first step toward
wisdom, but sharing data is the first step toward community
View user's profile Send private message
:-)
PostPosted: Wed May 19, 2004 3:31 pm Reply with quote
$t3
Regular user
Regular user
Joined: May 19, 2004
Posts: 15




thanx waraxe!
View user's profile Send private message
PostPosted: Thu May 20, 2004 10:40 pm Reply with quote
Stonecold
Regular user
Regular user
Joined: May 20, 2004
Posts: 10
Location: Virginia




Great Job. Yeah as another guy said, need any hosting let me know.
View user's profile Send private message Yahoo Messenger MSN Messenger
PostPosted: Fri May 21, 2004 10:50 am Reply with quote
Spacebom
Regular user
Regular user
Joined: May 20, 2004
Posts: 6
Location: Valladolid - Spain




Hi waraxe, I'm David (Spacebom) from DesarrolloNuke.org

I you would like to congratulate your work, is excellent, and very important, security it's the big problem of PHP-Nuke.

Good Bye guys! Wink
View user's profile Send private message Visit poster's website
PostPosted: Fri May 21, 2004 11:02 am Reply with quote
waraxe
Site admin
Site admin
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




For now, I think most of the big security flaws in PhpNuke have already been discovered and patched. That's my opinion - because I am searching PhpNuke's source code for more bugs, but the work gets harder with every day Wink
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Sun May 23, 2004 12:22 am Reply with quote
chatserv
Beginner
Beginner
Joined: May 18, 2004
Posts: 4




That has been the idea since day one, we'll get there eventually.
View user's profile Send private message Visit poster's website
PostPosted: Tue Jun 22, 2004 5:46 am Reply with quote
The Rock
Beginner
Beginner
Joined: Jun 22, 2004
Posts: 1




waraxe wrote:
For now, I think most of the big security flaws in PhpNuke have already been discovered and patched. That's my opinion - because I am searching PhpNuke's source code for more bugs, but the work gets harder with every day Wink


Awesome work; I am going to incorporate these fixes posthaste! As a Window developer, I know it's hard to hunt for bugs, but it is easier if the code is not yours! Wink I hope that these fixes have been suggested to the guys at phpnuke... I think some of these issue have been around for quite a few versions...
View user's profile Send private message Visit poster's website
[waraxe-2004-SA#030] - Multiple vulnerabilities in PhpNuke
www.waraxe.us Forum Index -> How to fix
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT
Page 1 of 1

Post new topicReply to topic


Powered by phpBB 2001-2008 phpBB Group



Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.126 Seconds