Phpnuke module.php vulnerability and PHP error_reporting issue
Posté le Dimanche, décembre 16 @ 02:05:22 CET par acz



As you know, there are many Cross site scripting issue on Phpnuke
modules and other web application using PHP.

There is a cross site scripting issue cause :
[1] there is a lack to checks from user input in module.php
[2] PHP does not have a good deal with error reporting

I found my website vulnerable to an other cross site scripting
vulnerability, i thougt the problem was in XForum (forum
module for phpnuke)
It was also, but it was too on the way that PHP reports errors and deals
with
error messages.

[ Phpnuke module.php vulnerability and PHP error_reporting issue ]
on 16 december by Cabezon Aurélien | aurelien.cabezon@iSecureLabs.com

As you know, there are many Cross site scripting issue on Phpnuke
modules
and other web application using PHP.

There is a cross site scripting issue cause :
[1] there is a lack to checks from user input in module.php
[2] PHP does not have a good deal with error reporting

I found my website vulnerable to an other cross site scripting
vulnerability, i thougt the problem was in XForum (forum
module for phpnuke)
It was also, but it was too on the way that PHP reports errors and deals
with
error messages.

---Vulnerable line in module.php---
include("modules/$name/$file.php");
---Vulnerable line in module.php---

Exploit :
http://host.com/modules.php?op=modload&name=XForum&file=[hostile
javascript]&fid=2

Hostile javascript could be : {script}alert(document.cookie);{/script}
that
display your cookie.
replace {} by <>

This crafted url cause the module.php script to make an PHP error
reporting
like this:

---php error report---
Warning: Failed opening 'modules/XForum/.php' for inclusion
(include_path='') in /home/foo/htdocs/modules.php on line 27
---php error report---

When your browser display the error reporting, it parses the hotile
javascript too...
I found an easy and fast way to fix this problem and other cross site
scripting issue regarding module.php and other web application using PHP
:
Just turn off PHP error reporting and wait for a fix from PHP devel team
:)
The error_reporting function should check for bad inputs.


Temp fix for phpnuke module.php:

---start of module.php---
error_reporting(0); //Add this line, Just turn off error_reporting

//original file

switch($op) {

   case "modload":/
if (!isset($mainfile)) { include("mainfile.php"); }
if (ereg("..",$name) || ereg("..",$file)) {
    echo "You are so cool";
    break;
} else {
    include("modules/$name/$file.php");
}
break;

   default:
die ("Sorry, you can't access this file directly...");
break;

}

---end of module.php---



regards,

---
Cabezon Aurélien | aurelien.cabezon@iSecureLabs.com
http://www.iSecureLabs.com | French Security Portal