<<< Date Index >>>     <<< Thread Index >>>

[SECURITYREASON.COM] phpnuke 7.6 Multiple vulnerabilities in Downloads Module cXIb8O3.13




-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[phpnuke 7.6 Multiple vulnerabilities in Downloads Module cXIb8O3.13]

Author: Maksymilian Arciemowicz (cXIb8O3)
Date: 5.4.2005
from securityreason.com TEAM

- --- 0.Description ---
PHP-Nuke is a Web Portal System, storytelling software, news system, online 
community or whatever you want to call it. Its goal is to have an automated web 
site to distribute news and articles with user system. Each user can submit 
comments to discuss the articles, similar to Slashdot and many others. 
Features: web admin, polls/surveys with comment, statistics, user customizable 
box, themes manager, friendly admin GUI, moderation system, sections manager, 
banner system, backend/headlines generation, Yahoo like search engine, 
Ephemerids manager, file manager, download manager, faq manager, advanced 
blocks system, reviews system, newsletter, content management, encyclopedia 
generator, md5 password encryption, phpBB Forums integration, support for 25 
languages, 100% modular and more. Written 100% in PHP and requires Apache, PHP 
and a SQL Database Server. Supports MySQL, PostgreSQL, Adabas, mSQL and many 
others.

- --- 1. Sql Injection ---
1.0
Sql Injection exists in function Add(). 

- --- line 301-310 ---
    $title = stripslashes(check_html(FixQuotes($title, "nohtml")));
    $url = stripslashes($url);
    $description = stripslashes(FixQuotes($description));
    $auth_name = stripslashes($auth_name);
    $email = stripslashes($email);
    $filesize = ereg_replace("\.","",$filesize);
    $filesize = ereg_replace("\,","",$filesize);
    $cat[0] = intval($cat[0]);
    $cat[1] = intval($cat[1]);
    $db->sql_query("INSERT INTO ".$prefix."_downloads_newdownload VALUES (NULL, 
'$cat[0]', '$cat[1]', '$title', '$url', '$description', '$auth_name', '$email', 
'$submitter', '$filesize', '$version', '$homepage')");
- --- line 301-310 ---

Varible $email, $url etc.
But this sql injection is INSERT. So url is.

http://[HOST]/[DIR]/modules.php?name=Downloads&d_op=Add&title=cXIb8O3&url=ma&description=POLSKA&email=',[SQL]

But why dosen't exists error? Because that is blind sql injection and you can 
not see error.

1.1
Sql Injection exist in function modifydownloadrequestS().

- --- line 2098-2014 ---
        $title = stripslashes(check_html($title, "nohtml"));
        $url = stripslashes($url);
        $description = stripslashes($description);
        $lid = intval($lid);
        $cat[0] = intval($cat[0]);
        $cat[1] = intval($cat[1]);
        $db->sql_query("insert into ".$prefix."_downloads_modrequest values 
(NULL, '$lid', '$cat[0]', '$cat[1]', '$title', '$url', '$description', 
'$ratinguser', '0', '$auth_name', '$email', '$filesize', '$version', 
'$homepage')");
- --- line 2098-2014 ---

And varible $email, $url etc.
This is Blind Sql Injection.
So url is:

http://[HOST]/[DIR]/modules.php?name=Downloads&d_op=modifydownloadrequestS&url=',[SQL]


1.2
This SQL Injection is non critical and blind. Insert in viewsdownload() 
function.


855#  if (!isset($min)) $min=0;
..
927#  $result=$db->sql_query("SELECT lid, url, title, description, date, hits, 
downloadratingsummary, totalvotes, totalcomments, filesize, version, homepage 
FROM ".$prefix."_downloads_downloads WHERE sid='$sid' order by $orderby limit 
$min,$perpage");


and url is

http://[HOST]/[DIR]/modules.php?name=Downloads&d_op=viewsdownload&min=[SQL]

so sql query is:

- ---
SELECT lid, url, title, description, date, hits, downloadratingsummary, 
totalvotes, totalcomments, filesize, version, homepage FROM 
nuke_downloads_downloads WHERE sid='0' order by title ASC limit [SQL],10
- ---

1.3
This SQL Injection is non critical and blind. Insert in search() function.

- --- line 1257-1171 ---
 if (!isset($min)) $min=0;
    if (!isset($max)) $max=$min+$downloadsresults;
    if(isset($orderby)) {
        $orderby = convertorderbyin($orderby);
    } else {
        $orderby = "title ASC";
    }
    if ($show!="") {
        $downloadsresults = $show;
    } else {
        $show=$downloadsresults;     
    }
    $query = check_html($query, nohtml);
    $query = addslashes($query);
    $result = $db->sql_query("SELECT lid, cid, title, url, description, date, 
hits, downloadratingsummary, totalvotes, totalcomments, filesize, version, 
homepage FROM ".$prefix."_downloads_downloads WHERE title LIKE '%$query%' OR 
description LIKE '%$query%' ORDER BY $orderby LIMIT $min,$downloadsresults");
- --- line 1257-1171 ---

Varible $min.

http://[HOST]/[DIR]/modules.php?name=Downloads&d_op=search&min=[SQL]

And SQL Query is

- --- 
SELECT lid, cid, title, url, description, date, hits, downloadratingsummary, 
totalvotes, totalcomments, filesize, version, homepage FROM 
nuke_downloads_downloads WHERE title LIKE '%%' OR description LIKE '%%' ORDER 
BY title ASC LIMIT [SQL],10
- ---

In all sql injection you don't can see errors. Why? Because that is security in 
phpnuke ;]

- --- 2. Fix ---
AD 1.0
Change

- ---
 $db->sql_query("INSERT INTO ".$prefix."_downloads_newdownload VALUES (NULL, 
'$cat[0]', '$cat[1]', '$title', '$url', '$description', '$auth_name', '$email', 
'$submitter', '$filesize', '$version', '$homepage')");
- ---

to

- ---
 $db->sql_query("INSERT INTO ".$prefix."_downloads_newdownload VALUES (NULL, 
'$cat[0]', '$cat[1]', '".addslashes($title)."', '".addslashes($url)."', 
'".addslashes($description)."', '".addslashes($auth_name)."', 
'".addslashes($email)."', '".addslashes($submitter)."', 
'".addslashes($filesize)."', '".addslashes($version)."', 
'".addslashes($homepage)."')");
- ---

AD 1.1
Change

- ---
$db->sql_query("insert into ".$prefix."_downloads_modrequest values (NULL, 
'$lid', '$cat[0]', '$cat[1]', '".addslashes($title)."', '".addslashes($url)."', 
'".addslashes($description)."', '".addslashes($ratinguser)."', '0', 
'".addslashes($auth_name)."', '".addslashes($email)."', 
'".addslashes($filesize)."', '".addslashes($version)."', 
'".addslashes($homepage)."')");
- ---

to

- ---
$db->sql_query("insert into ".$prefix."_downloads_modrequest values (NULL, 
'$lid', '$cat[0]', '$cat[1]', '$title', '$url', '$description', '$ratinguser', 
'0', '$auth_name', '$email', '$filesize', '$version', '$homepage')");
- ---

AD 1.2
Change

- ---
$result=$db->sql_query("SELECT lid, url, title, description, date, hits, 
downloadratingsummary, totalvotes, totalcomments, filesize, version, homepage 
FROM ".$prefix."_downloads_downloads WHERE sid='$sid' order by $orderby limit 
$min,$perpage");
- ---

to

- ---
if(!is_numeric($min)){
$min=0;
}
$result=$db->sql_query("SELECT lid, url, title, description, date, hits, 
downloadratingsummary, totalvotes, totalcomments, filesize, version, homepage 
FROM ".$prefix."_downloads_downloads WHERE sid='$sid' order by $orderby limit 
$min,$perpage");
- ---

AD 1.3
Change

- ---
    $result = $db->sql_query("SELECT lid, cid, title, url, description, date, 
hits, downloadratingsummary, totalvotes, totalcomments, filesize, version, 
homepage FROM ".$prefix."_downloads_downloads WHERE title LIKE '%$query%' OR 
description LIKE '%$query%' ORDER BY $orderby LIMIT $min,$downloadsresults");
- ---

to

- ---
if(!is_numeric($min)){
    $min=0;
    }
    $result = $db->sql_query("SELECT lid, cid, title, url, description, date, 
hits, downloadratingsummary, totalvotes, totalcomments, filesize, version, 
homepage FROM ".$prefix."_downloads_downloads WHERE title LIKE '%$query%' OR 
description LIKE '%$query%' ORDER BY $orderby LIMIT $min,$downloadsresults");
- ---

- --- 3. Greets ---

sp3x.

- --- 4.Contact ---
Author: Maksymilian Arciemowicz < cXIb8O3 >
Email: max [at] jestsuper [dot] pl or cxib [at] securityreason [dot] com
securityreason.com TEAM

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (FreeBSD)

iD8DBQFCVVoBznmvyJCR4zQRAsUVAJ9IPwpm5sfX3LCKPbqPzrV2Gxel4wCfcNUP
402j0+4ry0XAG5Iq1f9U1GU=
=iz2w
-----END PGP SIGNATURE-----