bugtraq - Re: Multiple vulnerabilities PHP-Nuke

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040609062123.21685.qmail@www.securityfocus.com>
Date: 9 Jun 2004 06:21:23 -0000
From: Squid <squidsecurity@...hmail.com>
To: bugtraq@...urityfocus.com
Subject: Re: Multiple vulnerabilities PHP-Nuke

In-Reply-To: <000001c44d6d$e6897a80$2002a8c0@...cxp1>

Since you said patches have been available for "many, many months", please provide links to them.  It appears you merely restricted access to this module on your site not that these were necessarily fixed.  A check of the patched code though will show for sure whether the problems were previously addressed. 

Even so, there has been at least two upgrades for PHPNuke in the past couple months.  If security patches are issued by third-parties but not incorporated into the main distribution, this leaves brand new users, hosts which offer auto-install versions, and those who upgrade susceptible to unfixed known vulnerabilities.  It also passes on the same ones to forked projects. 

I agree CPG-Nuke is not affected.  They do not have a Reviews module at least not in the default distribution.  betaNC Bundle and OSC2Nuke though have the same vulnerabilities reported here.  Other forks may have it too.

Ref Dark's para 2A: I couldn't reproduce this on Linux.  The warning for date() resulting in full path disclosure may be Windows unique.

Ref Dark's para 2B: This occurs only when magic_quotes_gpc is set to off.  PhpNuke is not written to handle it being either on and off.  It must be on.  I'll bet there are other vulnerabilities present in the script when it's off.

Squid

-----

>This does not apply to any site that has applied the security fixes
>available for many, many months.  This is only affecting phpnuke.org
>distro's, not any 'modified' or 'secured' distro, like betaNC, CPG-NUKE,
>and others...
>
>No additional patches dealing with these specifics below applied to
>php-nuke 7.0 only the security patches.
>
>A. Generates a proper ACCESS DENIED page, no PATH DISCLOSURE. =20
>-------------------------------------------------------------
>RESULT:
>
>"You are trying to access a restricted area.
>
>We are Sorry, but this section of our site is for Registered Users Only.
>You can register for free by clicking here, then you can
>access this section without restrictions. Thanks."
>
>B. No CSS exploit.  Same result as above.  Below example was sanitized
>prior to GET:
>------------------------------------------------------------------------
>------------
>RESULT:
>
>modules.php?name=3DReviews&rop=3Dpostcomment&id=3D'%3Ch1%3EDarkBicho%3C/h=
>1&tit
>le=3Da
>modules.php?name=3DReviews&rop=3Dpostcomment&id=3D'&title=3D%3Ch1%3EDarkB=
>icho%3C
>/h1%3E
>
>
>So as long as you've addressed the age-old bugs that still haven't been
>fixed in the basic PHP-Nuke distro's then you may be vulnerable.
>However these methods have long been squashed in patches available, and
>do not affect newer, secure distro's such as betaNC or CPG-Nuke.
>
>Again, I added no new patches to test these potentials in the last 30
>days.  And they simply are not a factor.
>
>Sincerely,
>
>J.
>j e r u v y a t s h a w d o t c a=20