| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20050407160559.17418.qmail@www.securityfocus.com>
Date: 7 Apr 2005 16:05:59 -0000
From: Maksymilian Arciemowicz <max@...tsuper.pl>
To: bugtraq@...urityfocus.com
Subject: [SECURITYREASON.COM] phpnuke 7.6 Multiple vulnerabilities in
Web_Links Module cXIb8O3.14
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[phpnuke 7.6 Multiple vulnerabilities in Web_Links Module cXIb8O3.14]
Author: Maksymilian Arciemowicz (cXIb8O3)
Date: 6.4.2005
from securityreason.com TEAM
- --- 0.Description ---
PHP-Nuke is a Web Portal System, storytelling software, news system, online community or whatever you want to call it. Its goal is to have an automated web site to distribute news and articles with user system. Each user can submit comments to discuss the articles, similar to Slashdot and many others. Features: web admin, polls/surveys with comment, statistics, user customizable box, themes manager, friendly admin GUI, moderation system, sections manager, banner system, backend/headlines generation, Yahoo like search engine, Ephemerids manager, file manager, download manager, faq manager, advanced blocks system, reviews system, newsletter, content management, encyclopedia generator, md5 password encryption, phpBB Forums integration, support for 25 languages, 100% modular and more. Written 100% in PHP and requires Apache, PHP and a SQL Database Server. Supports MySQL, PostgreSQL, Adabas, mSQL and many others.
- --- 1. Sql Injection ---
1.0
Sql Injection exist in function Add().
- --- line 273-280 ---
$title = stripslashes(check_html($title, "nohtml"));
$url = stripslashes($url);
$description = stripslashes($description);
$auth_name = stripslashes($auth_name);
$email = stripslashes($email);
$cat[0] = intval($cat[0]);
$cat[1] = intval($cat[1]);
$db->sql_query("insert into ".$prefix."_links_newlink values (NULL, '$cat[0]', '$cat[1]', '$title', '$url', '$description', '$auth_name', '$email', '$submitter')");
- --- line 273-280 ---
Varible $email, $url etc.
But this sql injection is in the INSERT. So url is.
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=Add&title=cXIb8O3&url=I&description=Spex&email=',[SQL]
But why dosen't exist error? Because that is blind sql injection and can not see errors.
so sql query is:
- ---
insert into nuke_links_newlink values (NULL, '0', '0', 'cXIb8O3', 'I', 'Spex', '', '',[SQL]', 'Admin')
- ---
1.1
Sql Injection exist in function modifylinkrequestS().
- --- line 1849-1855 ---
$title = stripslashes(check_html($title, "nohtml"));
$url = stripslashes($url);
$description = stripslashes($description);
$lid = intval($lid);
$cat[0] = intval($cat[0]);
$cat[1] = intval($cat[1]);
$db->sql_query("insert into ".$prefix."_links_modrequest values (NULL, '$lid', '$cat[0]', '$cat[1]', '$title', '$url', '$description', '$ratinguser', 0)");
- --- line 1849-1855 ---
And varible $email, $url etc.
This is Blind Sql Injection.
So url is:
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=modifylinkrequestS&url='[SQL]
sql query:
- ---
insert into nuke_links_modrequest values (NULL, '0', '0', '0', '', ''[SQL]', '', 'Admin', 0)
- ---
1.2
This SQL Injection is non critical and blind. Insert in viewlink() function.
655# if (!isset($min)) $min=0;
..
728# $result4 = $db->sql_query("SELECT lid, title, description, date, hits, linkratingsummary, totalvotes, totalcomments from ".$prefix."_links_links where cid='$cid' order by $orderby limit $min,$perpage");
and url is
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=viewlink&orderby=[SQL]&min=[SQL]
so sql query is:
- ---
SELECT lid, title, description, date, hits, linkratingsummary, totalvotes, totalcomments from nuke_links_links where cid='0' order by [SQL] limit [SQL],10
- ---
and check 3. Errors in functions
1.3
This SQL Injection is non critical and blind. Insert in search() function.
- --- line 942-956 ---
if (!isset($min)) $min=0;
if (!isset($max)) $max=$min+$linksresults;
if(isset($orderby)) {
$orderby = convertorderbyin($orderby);
} else {
$orderby = "title ASC";
}
if ($show!="") {
$linksresults = $show;
} else {
$show=$linksresults;
}
$query = check_html($query, nohtml);
$query = addslashes($query);
$result = $db->sql_query("SELECT lid, cid, sid, title, url, description, date, hits, linkratingsummary, totalvotes, totalcomments from ".$prefix."_links_links where title LIKE '%$query%' OR description LIKE '%$query%' ORDER BY $orderby LIMIT $min,$linksresults");
- --- line 942-956 ---
Varible $min, $show, $orderby.
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=search&query=sex&orderby=[SQL]&min=[SQL]&show=[SQL]
And SQL Query is
- ---
SELECT lid, cid, sid, title, url, description, date, hits, linkratingsummary, totalvotes, totalcomments from nuke_links_links where title LIKE '%sex%' OR description LIKE '%sex%' ORDER BY [SQL] LIMIT [SQL],[SQL]
- ---
and check 3. Errors in functions
1.4
This SQL Injection is non critical and blind. Insert in MostPopular() function.
558# $result3 = $db->sql_query("SELECT lid, cid, sid, title, description, date, hits, linkratingsummary, totalvotes, totalcomments from ".$prefix."_links_links order by hits DESC limit 0,$mostpoplinks");
Varible $mostpoplinks.
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=MostPopular&ratenum=[SQL]&ratetype=num
and sql query is:
- ---
SELECT lid, cid, sid, title, description, date, hits, linkratingsummary, totalvotes, totalcomments from nuke_links_links order by hits DESC limit 0,[SQL]
- ---
- --- 2. Path Disclousure ---
2.0
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=search&query=Hihihi&show=cXIb8O3
Error message :
- ---------------
Warning: Division by zero in /www/phpnuke/76/html/modules/Web_Links/index.php on line 1050
- ---------------
- --- 3. Errors in functions ---
Errors exists in functions convertorderbyin(), convertorderbytrans(), convertorderbyout().
For example convertorderbyin():
- ---
function convertorderbyin($orderby) {
if ($orderby == "titleA") $orderby = "title ASC";
if ($orderby == "dateA") $orderby = "date ASC";
if ($orderby == "hitsA") $orderby = "hits ASC";
if ($orderby == "ratingA") $orderby = "linkratingsummary ASC";
if ($orderby == "titleD") $orderby = "title DESC";
if ($orderby == "dateD") $orderby = "date DESC";
if ($orderby == "hitsD") $orderby = "hits DESC";
if ($orderby == "ratingD") $orderby = "linkratingsummary DESC";
return $orderby;
}
- ---
but if orderby=cXIb8O3? Convert don't work.
- --- 4. Fix ---
AD 1.0
Change
- ---
$db->sql_query("insert into ".$prefix."_links_newlink values (NULL, '$cat[0]', '$cat[1]', '$title', '$url', '$description', '$auth_name', '$email', '$submitter')");
- ---
to
- ---
$db->sql_query("insert into ".$prefix."_links_newlink values (NULL, '$cat[0]', '$cat[1]', '".addslashes($title)."', '".addslashes($url)."', '".addslashes($description)."', '".addslashes($auth_name)."', '".addslashes($email).", '".addslashes($submitter)."')");
- ---
AD 1.1
Change
- ---
$db->sql_query("insert into ".$prefix."_links_modrequest values (NULL, '$lid', '$cat[0]', '$cat[1]', '$title', '$url', '$description', '$ratinguser', 0)");
- ---
to
- ---
echo "insert into ".$prefix."_links_modrequest values (NULL, '$lid', '$cat[0]', '$cat[1]', '".addslashes($title)."', '".addslashes($url)."', '".addslashes($description)."', '".addslashes($ratinguser)."', 0)";
- ---
AD 1.2
Change
- ---
$result4 = $db->sql_query("SELECT lid, title, description, date, hits, linkratingsummary, totalvotes, totalcomments from ".$prefix."_links_links where cid='$cid' order by $orderby limit $min,$perpage");
- ---
to
- ---
if(!is_numeric($min)){
$min=0;
}
$result4 = $db->sql_query("SELECT lid, title, description, date, hits, linkratingsummary, totalvotes, totalcomments from ".$prefix."_links_links where cid='$cid' order by $orderby limit $min,$perpage");
- ---
AD 1.3
Change
- ---
$result = $db->sql_query("SELECT lid, cid, sid, title, url, description, date, hits, linkratingsummary, totalvotes, totalcomments from ".$prefix."_links_links where title LIKE '%$query%' OR description LIKE '%$query%' ORDER BY $orderby LIMIT $min,$linksresults");
- ---
to
- ---
if(!is_numeric($linksresults) AND $linksresults==0)
{
$linksresults=10;
}
$result = $db->sql_query("SELECT lid, cid, sid, title, url, description, date, hits, linkratingsummary, totalvotes, totalcomments from ".$prefix."_links_links where title LIKE '%$query%' OR description LIKE '%$query%' ORDER BY $orderby LIMIT ".intval($min).",$linksresults");
- ---
AD 1.4
Change
- ---
$result3 = $db->sql_query("SELECT lid, cid, sid, title, description, date, hits, linkratingsummary, totalvotes, totalcomments from ".$prefix."_links_links order by hits DESC limit 0,$mostpoplinks");
- ---
to
- ---
if(!is_numeric($mostpoplinks)) {
$mostpoplinks=10;
}
$result3 = $db->sql_query("SELECT lid, cid, sid, title, description, date, hits, linkratingsummary, totalvotes, totalcomments from ".$prefix."_links_links order by hits DESC limit 0,$mostpoplinks");
- ---
AD 3.0
Change function convertorderbyin()
to
- ---
function convertorderbyin($orderby) {
if ($orderby != "titleA" AND $orderby != "dateA" AND $orderby != "hitsA" AND $orderby != "ratingA" AND $orderby != "titleD" AND $orderby != "dateD" AND $orderby != "hitsD" AND $orderby != "ratingD") {
$orderby = "title ASC";
}
if ($orderby == "titleA") $orderby = "title ASC";
if ($orderby == "dateA") $orderby = "date ASC";
if ($orderby == "hitsA") $orderby = "hits ASC";
if ($orderby == "ratingA") $orderby = "linkratingsummary ASC";
if ($orderby == "titleD") $orderby = "title DESC";
if ($orderby == "dateD") $orderby = "date DESC";
if ($orderby == "hitsD") $orderby = "hits DESC";
if ($orderby == "ratingD") $orderby = "linkratingsummary DESC";
return $orderby;
}
- ---
Change function convertorderbytrans()
to
- ---
function convertorderbytrans($orderby) {
if ($orderby != "hits ASC" AND $orderby != "hits DESC" AND $orderby != "title ASC" AND $orderby != "title DESC" AND $orderby != "date ASC" AND $orderby != "date DESC" AND $orderby != "linkratingsummary ASC" AND $orderby != "linkratingsummary DESC") {
$orderbyTrans = ""._POPULARITY1."";
}
if ($orderby == "hits ASC") $orderbyTrans = ""._POPULARITY1."";
if ($orderby == "hits DESC") $orderbyTrans = ""._POPULARITY2."";
if ($orderby == "title ASC") $orderbyTrans = ""._TITLEAZ."";
if ($orderby == "title DESC") $orderbyTrans = ""._TITLEZA."";
if ($orderby == "date ASC") $orderbyTrans = ""._DATE1."";
if ($orderby == "date DESC") $orderbyTrans = ""._DATE2."";
if ($orderby == "linkratingsummary ASC") $orderbyTrans = ""._RATING1."";
if ($orderby == "linkratingsummary DESC") $orderbyTrans = ""._RATING2."";
return $orderbyTrans;
}
- ---
Change function convertorderbyout()
to
- ---
function convertorderbyout($orderby) {
if ($orderby != "hits ASC" AND $orderby != "hits DESC" AND $orderby != "title ASC" AND $orderby != "title DESC" AND $orderby != "date ASC" AND $orderby != "date DESC" AND $orderby != "linkratingsummary ASC" AND $orderby != "linkratingsummary DESC") {
$orderby = "titleA";
}
if ($orderby == "title ASC") $orderby = "titleA";
if ($orderby == "date ASC") $orderby = "dateA";
if ($orderby == "hits ASC") $orderby = "hitsA";
if ($orderby == "linkratingsummary ASC") $orderby = "ratingA";
if ($orderby == "title DESC") $orderby = "titleD";
if ($orderby == "date DESC") $orderby = "dateD";
if ($orderby == "hits DESC") $orderby = "hitsD";
if ($orderby == "linkratingsummary DESC") $orderby = "ratingD";
return $orderby;
}
- ---
- --- 5. Greets ---
sp3x
- --- 6.Contact ---
Author: Maksymilian Arciemowicz < cXIb8O3 >
Email: max [at] jestsuper [dot] pl or cxib [at] securityreason [dot] com
securityreason.com TEAM
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (FreeBSD)
iD8DBQFCVVpCznmvyJCR4zQRApbvAJ9Rw3j1RsIZ+UbFGfhnpfJteenUyQCfZI5M
aCv6WjmzYvJyvheHsluCfe0=
=vaqN
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists