bugtraq - PHP Nuke <= 8.0.0.3.3b SQL Injections and Bypass SQL Injection Protection vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070417124256.4886.qmail@securityfocus.com>
Date: 17 Apr 2007 12:42:56 -0000
From: programmer@...biansite.com
To: bugtraq@...urityfocus.com
Subject: PHP Nuke <= 8.0.0.3.3b SQL Injections and Bypass SQL Injection
 Protection vulnerabilities

PHP Nuke <= 8.0.0.3.3b SQL Injections and Bypass SQL Injection Protection vulnerabilities

________________________
PROGRAM: PHP-Nuke
HOMEPAGE: http://phpnuke.org/
VERSION: All version
BUG: PHP Nuke <= 8.0.0.3.3b Bypass SQL Injection Protection and SQL Injections vulnerabilities
AUTHOR: Aleksandar
________________________




Let's look at source code from mainfile.php line 435
__________________________________________

  //Union Tap
  //Copyright Zhen-Xjell 2004 http://nukecops.com
  //Beta 3 Code to prevent UNION SQL Injections
  unset($matches);
  unset($loc);
  if(isset($_SERVER['QUERY_STRING'])) {
    if (preg_match("/([OdWo5NIbpuU4V2iJT0n]{5}) /", rawurldecode($loc=$_SERVER['QUERY_STRING']), $matches)) {
      die('Illegal Operation 1');
    }
  }
  if(!isset($admin) OR (isset($admin) AND !is_admin($admin))) {
    $queryString = $_SERVER['QUERY_STRING'];
	if (($_SERVER['PHP_SELF'] != "/index.php") OR !isset($url))
	{
	   if (stristr($queryString,'http://')) die('Illegal Operation 2');
	}
    if ((stristr($queryString,'%20union%20')) OR (stristr($queryString,'/*')) OR (stristr($queryString,'*/union/*')) OR (stristr($queryString,'c2nyaxb0')) OR (stristr($queryString,'+union+'))  OR ((stristr($queryString,'cmd=')) AND (!stristr($queryString,'&cmd'))) OR ((stristr($queryString,'exec')) AND (!stristr($queryString,'execu'))) OR (stristr($queryString,'concat'))) {
      die('Illegal Operation 3');
    }
  }__________________________________________

So we can se different filters. :)

Let’s start whit a testing:

TEST 1
http://localhost/nuke/?/*
So we will se this message: Illegal Operation 3

TEST 2
http://localhost/nuke/?%2f*

Yeah - we got through :)

TEST 3
http://localhost/?%20UNION%20SELECT
 
Illegal Operation 1

TEST 4
http://localhost:8080/html80/?%2f**/UNION%2f**/SELECT ..

Yeah - we got through :)




PATCH:
__________________________________________

if ((stristr($queryString,'%20union%20')) OR (stristr($queryString,'*%2f*')) OR (stristr($queryString,'/*')) OR (stristr($queryString,'*/union/*')) OR (stristr($queryString,'c2nyaxb0')) OR (stristr($queryString,'+union+'))  OR ((stristr($queryString,'cmd=')) AND (!stristr($queryString,'&cmd'))) OR ((stristr($queryString,'exec')) AND (!stristr($queryString,'execu'))) OR (stristr($queryString,'concat'))) {
      die('Illegal Operation');
    }
__________________________________________



Multiple SQL Injection vulnerability in Web_Links, News and Download module



+++++++++++++++++++++++++++

PHP.ini
Magic Quotes = OFF 
Register Global = ON
+++++++++++++++++++++++++++


Now Let's look at source code from Web_Links/index.php:

Vulnerability function

function viewlinkcomments($lid) {
	global $prefix, $db, $admin, $bgcolor2, $module_name, $admin_file;
	include("header.php");
	include("modules/$module_name/l_config.php");
	menu(1);
	$row = $db->sql_fetchrow($db->sql_query("SELECT title FROM ".$prefix."_links_links WHERE lid='$lid'")); // BUG ---> $lid
              $ttitle = filter($row['title'], "nohtml");
	$lid = intval(trim($lid)); //WTF?<===== lol ??????????????? :):):):):)
	echo "<br>";
...


How to fix:

Add $lid = intval(trim($lid)); before $row = $db->sql_fetchrow($db->sql_query("SELECT title FROM ".$prefix."_links_links WHERE lid='$lid'")); 

___________________________________________
function viewlinkcomments($lid) {
	global $prefix, $db, $admin, $bgcolor2, $module_name, $admin_file;
	include("header.php");
	include("modules/$module_name/l_config.php");
	menu(1);
            $lid = intval(trim($lid)); // FIX
	$row = $db->sql_fetchrow($db->sql_query("SELECT title FROM ".$prefix."_links_links WHERE lid='$lid'")); 
              $ttitle = filter($row['title'], "nohtml");
	//$lid = intval(trim($lid)); // REMOVE THIS LINE !!!!!!!
	echo "<br>";
...
__________________________________________________

Vulnerability Functions:

function viewlinkcomments($lid) {
function viewlinkeditorial($lid){
function viewlinkcomments($lid){
function ratelink($lid, $user) {

The "$lid" variable isn't filtered, so if we bypass the sql injection protection we can execute arbitrary sql commands.

SQL Injection vulnerability in Downloads
Vulnerability Functions:

function viewdownloadeditorial($lid) {
function viewdownloadcomments($lid) {
function ratedownload($lid, $user) {

The "$lid" variable isn't filtered , so if we bypass the sql injection protection we can execute arbitrary sql commands.


SQL Injection vulnerability in News
Vulnerability Function:

function rate_complete($sid, $rated=0, $score) {

The "$sid" variable isn't filtered , so if we bypass the sql injection protection we can execute arbitrary sql commands.

Best Regards
Aleksandar
Programmer and Web Developer