ZH2005-03SA -- multiple vulnerabilities in NukeBookmarks .6

[Gerardo Astharot Di Giacomo]

ZH2005-03SA -- multiple vulnerabilities in NukeBookmarks .6

Author: Gerardo 'Astharot' Di Giacomo
Date: 26 March 2005

Product: NukeBookmarks .6
URL: http://nukebookmarks.sourceforge.net/

About the product
-----------------
From the home page:
"Nuke Bookmarks is a module for PHP-Nuke that allows users to store their own personal bookmarks on the server, much like Yahoo Bookmarks".

Vulnerabilities summary
-----------------------
1) Full path disclosure
2) Cross Site Scripting
3) SQL Injection

Details
-------
1) Full path disclosure
It's possible to retrieve the full installation URL of the website. In "marks.php" file, there are some queries to the database. If some parameters miss or some strange characters are submitted, the functions that get results from the database will return
an error.

Examples:
http://www.nukesite.com/modules.php?...rks&file=marks
http://www.nukesite.com/modules.php?...ks&category=1\'

2) Cross Site Scripting
Almost all of the variables supplied by the user aren't checked and sanitized. It's possible to inject HTML code into page and do a cross site scripting attack.

Examples:
http://www.nukesite.com/modules.php?...l_cat&catname=[htmlcode]
http://www.nukesite.com/modules.php?...mark&markname=[htmlcode]
http://www.nukesite.com/modules.php?...t_cat&catname=[htmlcode]

http://www.nukesite.com/modules.php?...at&catcomment=[htmlcode]
http://www.nukesite.com/modules.php?...marks&catname=[htmlcode]
http://www.nukesite.com/modules.php?...arks&category=[htmlcode]

These other strings are potentially vulnerable but not exploitable:
http://www.nukesite.com/modules.php?...mark&markname=[htmlcode]
http://www.nukesite.com/modules.php?..._mark&markurl=[htmlcode]
http://www.nukesite.com/modules.php?...k&markcomment=[htmlcode]

3) SQL Injection
It's possible to get any content from the database by exploiting a SQL Injection vulnerability in "marks.php" file.

Example:
http://www.nukesite.com/modules.php?...20nuke_authors

This example will get the list of PHPNuke authors and the relative hashes of the passwords.

Solution
--------
Download the latest version of NukeBookmarks (.7).

Contacts
--------
astharot@zone-h.org
http://www.zone-h.org - http://www.zone-h.it

Original URL: http://zone-h.org/advisories/read/id=7356

[Paul Laudanski]

On 26 Mar 2005, Gerardo Astharot Di Giacomo wrote:
> Product: NukeBookmarks .6
> URL: http://nukebookmarks.sourceforge.net/

> 1) Full path disclosure
> It's possible to retrieve the full installation URL of the website. In "marks.php" file, there are some queries to the database. If some parameters miss or some strange characters are submitted, the functions that get results from the database will retu
rn an error.

I can understand how full path disclosure can be an issue, however, in a
production environment the PHP settings to display errors ought to be
disabled. As such, full path disclosure goes away.

> 3) SQL Injection
> It's possible to get any content from the database by exploiting a SQL Injection vulnerability in "marks.php" file.
>
> This example will get the list of PHPNuke authors and the relative hashes of the passwords.

That is true if the default table names are used. However it would be
worth noting that with any web presence that uses a backend database, the
prefix ought to be changed to something random and non-default.

Does this completely solve the issue, of course not, but it can stop the
script kiddy attacks. For more on this:

http://unixwiz.net/techtips/sql-injection.html

Thanks for the disclosure.

--
Sincerely,

Paul Laudanski .. Computer Cops, LLC.
CastleCops(SM)... http://castlecops.com
CC Blog ......... http://blog.castlecops.com
Staff Blogs ..... http://busterbunny.castlecops.com
Our Vision ...... http://castlecops.com/postt63382.html

http://cuddlesnkisses.com http://justalittlepoke.com http://zhen-xjell.com