 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 119
 Members: 0
 Total: 119
|
|
|
|
|
|
Full disclosure |
|
CyberDanube Security Research 20251014-0 | Multiple Vulnerabilities in Phoenix Contact QUINT4 UPS
apis.google.com - Insecure redirect via __lu parameter(exploited in the wild)
Urgent Security Vulnerabilities Discovered in Mercku Routers Model M6a
Re: Security Advisory: Multiple High-Severity Vulnerabilities in Suno.com (JWT Leakage, IDOR, DoS)
Security Advisory: Multiple High-Severity Vulnerabilities in Suno.com (JWT Leakage, IDOR, DoS)
[SBA-ADV-20250730-01] CVE-2025-39664: Checkmk Path Traversal
[SBA-ADV-20250724-01] CVE-2025-32919: Checkmk Agent Privilege Escalation via Insecure Temporary Files
CVE-2025-59397 - Open Web Analytics SQL Injection
Re: [FD]Full Disclosure: CVE-2025-31200 & CVE-2025-31201 – 0-Click iMessage Chain ? Secure Enclave Key Theft, Wormable RCE, Crypto Theft
Re: Full Disclosure: CVE-2025-31200 & CVE-2025-31201 – 0-Click iMessage Chain ? Secure Enclave Key Theft, Wormable RCE, Crypto Theft
Re: Defense in depth -- the Microsoft way (part 93): SRP/SAFERwhitelisting goes black on Windows 11
Re: [FD]: "Glass Cage" – Zero-Click iMessage ? Persistent iOS Compromise + Bricking (CVE-2025-24085 / 24201, CNVD-2025-07885)
Re: [FD]Full Disclosure: CVE-2025-31200 & CVE-2025-31201 – 0-Click iMessage Chain ? Secure Enclave Key Theft, Wormable RCE, Crypto Theft
Samtools v1.22.1 Uncontrolled Memory Allocation from Large BED Intervals Causes Denial-of-Service in Samtools/HTSlib
Samtools v1.22.1 Improper Handling of Excessive Histogram Bin Counts in Samtools Coverage Leads to Stack Overflow
|
|
|
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
[waraxe-2004-SA#036] [Multiple security holes in PhpNuke] |
|
 Posted: Sun Jul 18, 2004 5:38 pm |
 |
|
| genoxide |
| Regular user |
 |
|
| Joined: Jun 14, 2004 |
| Posts: 15 |
|
|
|
 |
|
 |
|
Ok i've tested this report on nuke 6.9 and 7.3 and heres my 2 cents 
| Quote: | A1 - full path disclosure in "/modules/Search/index.php":
Go to search page:
http://localhost/nuke73/modules.php?name=Search
and enter to search field "**" (without double quotes).
Or enter plus sign "+".
As result there will be standard php error messages, revealing full path:
Warning: eregi(): REG_BADRPT: in D:\apache_wwwroot\nuke73\modules\Search\index.php on line 228
Warning: eregi(): REG_BADRPT: in D:\apache_wwwroot\nuke73\modules\Search\index.php on line 232
Warning: eregi(): REG_BADRPT: in D:\apache_wwwroot\nuke73\modules\Search\index.php on line 235 |
Don't get any off those errors, maybe my php.ini? 
$sid = intval($_POST['sid']);
$max = intval($_POST['max']);
$sel1 = '';
$sel2 = '';
$sel3 = '';
$sel4 = '';
$sel5 = '';
$match = '';
$mod1 = '';
$mod2 = '';
$mod3 = '';
| Quote: | C - Sql Injection
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
C1 - noncritical sql injection case in "/modules/Search/index.php":
Reason is unsanitized user-submitted variable "$min", which gets delievered directly
to sql request, afrer "ORDER BY / LIMIT" keywords. In mysql version 4.0 its not useful for exploiting,
but in case of new version 4.1, where subselects functionality will be available, there will be
possibility to use blind sql injection methods. So - this security bug must be fixed ASAP.
C2 - critical sql injection case in "/modules/Search/index.php":
Yeah, yeah, yeah - AGAIIIIIN! Fatal sql injection...
"Use the Source, Luke" --> let's look @ original code
----------------[ original source ]-----------------
$query = addslashes($query);
if ($type=="stories" OR !$type)
{
if ($category > 0)
{
$categ = "AND catid='$category' ";
}
elseif ($category == 0)
{
$categ = "";
}
$q = "select s.sid, s.aid, s.informant, s.title, s.time, s.hometext, s.bodytext,
a.url, s.comments, s.topic from ".$prefix."_stories s, ".$prefix."_authors a
where s.aid=a.aid $queryalang $categ";
if (isset($query)) $q .= "AND (s.title LIKE '%$query%' OR s.hometext LIKE '%$query%'
OR s.bodytext LIKE '%$query%' OR s.notes LIKE '%$query%') ";
if ($author != "") $q .= "AND s.aid='$author' ";
if ($topic != "") $q .= "AND s.topic='$topic' ";
if ($days != "" && $days!=0) $q .= "AND TO_DAYS(NOW()) - TO_DAYS(time) <= '$days' ";
$q .= " ORDER BY s.time DESC LIMIT $min,$offset";
$t = $topic;
$result5 = $db->sql_query($q);
----------------[/original source ]-----------------
What we can see here, is that construction "if/elseif" misses ending part "/else".
And if we deliver there "$category" as < 0, then variable "$categ" will be uninitialized.
So - let's get dirty
----------------[ real life exploit ]---------------
http://localhost/nuke73/modules.php?name=Search&type=stories&query=f00bar&category=-1
&categ=%20and%201=2%20UNION%20SELECT%200,0,aid,pwd,0,0,0,0,0,0%20from%20nuke_authors/* |
there are 2 ways of doing this
#1 by making $categ = intval($categ);
#2 changing the code to:
| Code: | if ($type=="stories" OR !$type)
{
if ($category > 0)
{
$categ = "AND catid='$category' ";
}
elseif ($category == 0)
{
$categ = "";
} else {
$categ = "";
}
|
cheers |
|
|
|
|
|
|
|
|
| Posted: Thu Aug 05, 2004 2:05 am |
|
|
| chatserv |
| Beginner |
 |
|
| Joined: May 18, 2004 |
| Posts: 4 |
|
|
|
|
|
|
|
For the last one this should be enough:
| Code: | if ($type=="stories" OR !$type)
{
if ($category > 0)
{
$categ = "AND catid='$category' ";
} else {
$categ = "";
} |
Originally the string checks if $category is greater than 0 give $categ a value else if $category equals 0 make $categ blank else make $categ blank, with the modified string it now reads if $category is greater than 0 give $categ a value else for all other conditions make $categ blank, one less check, same results. |
|
|
|
|
|
|
|
|
| Posted: Thu Aug 05, 2004 2:11 am |
|
|
| chatserv |
| Beginner |
|
|
| Joined: May 18, 2004 |
| Posts: 4 |
|
|
|
|
|
|
|
On that note the module has another vulnerability where a variable that was left wide open is being exploited: $instory, consider the following block of code:
| Code: | } elseif ($type=="comments") {
/*
$sid = intval($sid);
if (isset($sid)) {
$row7 = $db->sql_fetchrow($db->sql_query("SELECT title from ".$prefix."_stories where sid='$sid'"));
$st_title = $row7['title'];
$instory = "AND sid='$sid'";
} else {
$instory = "";
}
*/
$result8 = $db->sql_query("SELECT tid, sid, subject, date, name from ".$prefix."_comments where (subject like '%$query%' OR comment like '%$query%') $instory order by date DESC limit $min,$offset"); |
$instory gets used in the query but the block of code in which it gets set was commented out, hence no actual value gets defined for it nor is it validated, removing $instory from the query should take care of that one. |
|
|
|
|
|
www.waraxe.us Forum Index -> How to fix
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
