[SECURITYREASON.COM] phpnuke 7.6 Multiple vulnerabilities in Web_Links Module cXIb8O3.14
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[phpnuke 7.6 Multiple vulnerabilities in Web_Links Module cXIb8O3.14]
Author: Maksymilian Arciemowicz (cXIb8O3)
Date: 6.4.2005
from securityreason.com TEAM
- --- 0.Description ---
PHP-Nuke is a Web Portal System, storytelling software, news system, online
community or whatever you want to call it. Its goal is to have an automated web
site to distribute news and articles with user system. Each user can submit
comments to discuss the articles, similar to Slashdot and many others.
Features: web admin, polls/surveys with comment, statistics, user customizable
box, themes manager, friendly admin GUI, moderation system, sections manager,
banner system, backend/headlines generation, Yahoo like search engine,
Ephemerids manager, file manager, download manager, faq manager, advanced
blocks system, reviews system, newsletter, content management, encyclopedia
generator, md5 password encryption, phpBB Forums integration, support for 25
languages, 100% modular and more. Written 100% in PHP and requires Apache, PHP
and a SQL Database Server. Supports MySQL, PostgreSQL, Adabas, mSQL and many
others.
- --- 1. Sql Injection ---
1.0
Sql Injection exist in function Add().
- --- line 273-280 ---
$title = stripslashes(check_html($title, "nohtml"));
$url = stripslashes($url);
$description = stripslashes($description);
$auth_name = stripslashes($auth_name);
$email = stripslashes($email);
$cat[0] = intval($cat[0]);
$cat[1] = intval($cat[1]);
$db->sql_query("insert into ".$prefix."_links_newlink values (NULL,
'$cat[0]', '$cat[1]', '$title', '$url', '$description', '$auth_name', '$email',
'$submitter')");
- --- line 273-280 ---
Varible $email, $url etc.
But this sql injection is in the INSERT. So url is.
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=Add&title=cXIb8O3&url=I&description=Spex&email=',[SQL]
But why dosen't exist error? Because that is blind sql injection and can not
see errors.
so sql query is:
- ---
insert into nuke_links_newlink values (NULL, '0', '0', 'cXIb8O3', 'I', 'Spex',
'', '',[SQL]', 'Admin')
- ---
1.1
Sql Injection exist in function modifylinkrequestS().
- --- line 1849-1855 ---
$title = stripslashes(check_html($title, "nohtml"));
$url = stripslashes($url);
$description = stripslashes($description);
$lid = intval($lid);
$cat[0] = intval($cat[0]);
$cat[1] = intval($cat[1]);
$db->sql_query("insert into ".$prefix."_links_modrequest values (NULL,
'$lid', '$cat[0]', '$cat[1]', '$title', '$url', '$description', '$ratinguser',
0)");
- --- line 1849-1855 ---
And varible $email, $url etc.
This is Blind Sql Injection.
So url is:
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=modifylinkrequestS&url='[SQL]
sql query:
- ---
insert into nuke_links_modrequest values (NULL, '0', '0', '0', '', ''[SQL]',
'', 'Admin', 0)
- ---
1.2
This SQL Injection is non critical and blind. Insert in viewlink() function.
655# if (!isset($min)) $min=0;
..
728# $result4 = $db->sql_query("SELECT lid, title, description, date, hits,
linkratingsummary, totalvotes, totalcomments from ".$prefix."_links_links where
cid='$cid' order by $orderby limit $min,$perpage");
and url is
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=viewlink&orderby=[SQL]&min=[SQL]
so sql query is:
- ---
SELECT lid, title, description, date, hits, linkratingsummary, totalvotes,
totalcomments from nuke_links_links where cid='0' order by [SQL] limit [SQL],10
- ---
and check 3. Errors in functions
1.3
This SQL Injection is non critical and blind. Insert in search() function.
- --- line 942-956 ---
if (!isset($min)) $min=0;
if (!isset($max)) $max=$min+$linksresults;
if(isset($orderby)) {
$orderby = convertorderbyin($orderby);
} else {
$orderby = "title ASC";
}
if ($show!="") {
$linksresults = $show;
} else {
$show=$linksresults;
}
$query = check_html($query, nohtml);
$query = addslashes($query);
$result = $db->sql_query("SELECT lid, cid, sid, title, url, description,
date, hits, linkratingsummary, totalvotes, totalcomments from
".$prefix."_links_links where title LIKE '%$query%' OR description LIKE
'%$query%' ORDER BY $orderby LIMIT $min,$linksresults");
- --- line 942-956 ---
Varible $min, $show, $orderby.
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=search&query=sex&orderby=[SQL]&min=[SQL]&show=[SQL]
And SQL Query is
- ---
SELECT lid, cid, sid, title, url, description, date, hits, linkratingsummary,
totalvotes, totalcomments from nuke_links_links where title LIKE '%sex%' OR
description LIKE '%sex%' ORDER BY [SQL] LIMIT [SQL],[SQL]
- ---
and check 3. Errors in functions
1.4
This SQL Injection is non critical and blind. Insert in MostPopular() function.
558# $result3 = $db->sql_query("SELECT lid, cid, sid, title, description, date,
hits, linkratingsummary, totalvotes, totalcomments from ".$prefix."_links_links
order by hits DESC limit 0,$mostpoplinks");
Varible $mostpoplinks.
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=MostPopular&ratenum=[SQL]&ratetype=num
and sql query is:
- ---
SELECT lid, cid, sid, title, description, date, hits, linkratingsummary,
totalvotes, totalcomments from nuke_links_links order by hits DESC limit 0,[SQL]
- ---
- --- 2. Path Disclousure ---
2.0
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=search&query=Hihihi&show=cXIb8O3
Error message :
- ---------------
Warning: Division by zero in /www/phpnuke/76/html/modules/Web_Links/index.php
on line 1050
- ---------------
- --- 3. Errors in functions ---
Errors exists in functions convertorderbyin(), convertorderbytrans(),
convertorderbyout().
For example convertorderbyin():
- ---
function convertorderbyin($orderby) {
if ($orderby == "titleA") $orderby = "title ASC";
if ($orderby == "dateA") $orderby = "date ASC";
if ($orderby == "hitsA") $orderby = "hits ASC";
if ($orderby == "ratingA") $orderby = "linkratingsummary ASC";
if ($orderby == "titleD") $orderby = "title DESC";
if ($orderby == "dateD") $orderby = "date DESC";
if ($orderby == "hitsD") $orderby = "hits DESC";
if ($orderby == "ratingD") $orderby = "linkratingsummary DESC";
return $orderby;
}
- ---
but if orderby=cXIb8O3? Convert don't work.
- --- 4. Fix ---
AD 1.0
Change
- ---
$db->sql_query("insert into ".$prefix."_links_newlink values (NULL,
'$cat[0]', '$cat[1]', '$title', '$url', '$description', '$auth_name', '$email',
'$submitter')");
- ---
to
- ---
$db->sql_query("insert into ".$prefix."_links_newlink values (NULL,
'$cat[0]', '$cat[1]', '".addslashes($title)."', '".addslashes($url)."',
'".addslashes($description)."', '".addslashes($auth_name)."',
'".addslashes($email).", '".addslashes($submitter)."')");
- ---
AD 1.1
Change
- ---
$db->sql_query("insert into ".$prefix."_links_modrequest values (NULL,
'$lid', '$cat[0]', '$cat[1]', '$title', '$url', '$description', '$ratinguser',
0)");
- ---
to
- ---
echo "insert into ".$prefix."_links_modrequest values (NULL, '$lid', '$cat[0]',
'$cat[1]', '".addslashes($title)."', '".addslashes($url)."',
'".addslashes($description)."', '".addslashes($ratinguser)."', 0)";
- ---
AD 1.2
Change
- ---
$result4 = $db->sql_query("SELECT lid, title, description, date, hits,
linkratingsummary, totalvotes, totalcomments from ".$prefix."_links_links where
cid='$cid' order by $orderby limit $min,$perpage");
- ---
to
- ---
if(!is_numeric($min)){
$min=0;
}
$result4 = $db->sql_query("SELECT lid, title, description, date, hits,
linkratingsummary, totalvotes, totalcomments from ".$prefix."_links_links where
cid='$cid' order by $orderby limit $min,$perpage");
- ---
AD 1.3
Change
- ---
$result = $db->sql_query("SELECT lid, cid, sid, title, url, description, date,
hits, linkratingsummary, totalvotes, totalcomments from ".$prefix."_links_links
where title LIKE '%$query%' OR description LIKE '%$query%' ORDER BY $orderby
LIMIT $min,$linksresults");
- ---
to
- ---
if(!is_numeric($linksresults) AND $linksresults==0)
{
$linksresults=10;
}
$result = $db->sql_query("SELECT lid, cid, sid, title, url, description,
date, hits, linkratingsummary, totalvotes, totalcomments from
".$prefix."_links_links where title LIKE '%$query%' OR description LIKE
'%$query%' ORDER BY $orderby LIMIT ".intval($min).",$linksresults");
- ---
AD 1.4
Change
- ---
$result3 = $db->sql_query("SELECT lid, cid, sid, title, description, date,
hits, linkratingsummary, totalvotes, totalcomments from ".$prefix."_links_links
order by hits DESC limit 0,$mostpoplinks");
- ---
to
- ---
if(!is_numeric($mostpoplinks)) {
$mostpoplinks=10;
}
$result3 = $db->sql_query("SELECT lid, cid, sid, title, description, date,
hits, linkratingsummary, totalvotes, totalcomments from ".$prefix."_links_links
order by hits DESC limit 0,$mostpoplinks");
- ---
AD 3.0
Change function convertorderbyin()
to
- ---
function convertorderbyin($orderby) {
if ($orderby != "titleA" AND $orderby != "dateA" AND $orderby != "hitsA" AND
$orderby != "ratingA" AND $orderby != "titleD" AND $orderby != "dateD" AND
$orderby != "hitsD" AND $orderby != "ratingD") {
$orderby = "title ASC";
}
if ($orderby == "titleA") $orderby = "title ASC";
if ($orderby == "dateA") $orderby = "date ASC";
if ($orderby == "hitsA") $orderby = "hits ASC";
if ($orderby == "ratingA") $orderby = "linkratingsummary ASC";
if ($orderby == "titleD") $orderby = "title DESC";
if ($orderby == "dateD") $orderby = "date DESC";
if ($orderby == "hitsD") $orderby = "hits DESC";
if ($orderby == "ratingD") $orderby = "linkratingsummary DESC";
return $orderby;
}
- ---
Change function convertorderbytrans()
to
- ---
function convertorderbytrans($orderby) {
if ($orderby != "hits ASC" AND $orderby != "hits DESC" AND $orderby != "title
ASC" AND $orderby != "title DESC" AND $orderby != "date ASC" AND $orderby !=
"date DESC" AND $orderby != "linkratingsummary ASC" AND $orderby !=
"linkratingsummary DESC") {
$orderbyTrans = ""._POPULARITY1."";
}
if ($orderby == "hits ASC") $orderbyTrans =
""._POPULARITY1."";
if ($orderby == "hits DESC") $orderbyTrans =
""._POPULARITY2."";
if ($orderby == "title ASC") $orderbyTrans = ""._TITLEAZ."";
if ($orderby == "title DESC") $orderbyTrans = ""._TITLEZA."";
if ($orderby == "date ASC") $orderbyTrans = ""._DATE1."";
if ($orderby == "date DESC") $orderbyTrans = ""._DATE2."";
if ($orderby == "linkratingsummary ASC") $orderbyTrans = ""._RATING1."";
if ($orderby == "linkratingsummary DESC") $orderbyTrans = ""._RATING2."";
return $orderbyTrans;
}
- ---
Change function convertorderbyout()
to
- ---
function convertorderbyout($orderby) {
if ($orderby != "hits ASC" AND $orderby != "hits DESC" AND $orderby != "title
ASC" AND $orderby != "title DESC" AND $orderby != "date ASC" AND $orderby !=
"date DESC" AND $orderby != "linkratingsummary ASC" AND $orderby !=
"linkratingsummary DESC") {
$orderby = "titleA";
}
if ($orderby == "title ASC") $orderby = "titleA";
if ($orderby == "date ASC") $orderby = "dateA";
if ($orderby == "hits ASC") $orderby = "hitsA";
if ($orderby == "linkratingsummary ASC") $orderby = "ratingA";
if ($orderby == "title DESC") $orderby = "titleD";
if ($orderby == "date DESC") $orderby = "dateD";
if ($orderby == "hits DESC") $orderby = "hitsD";
if ($orderby == "linkratingsummary DESC") $orderby = "ratingD";
return $orderby;
}
- ---
- --- 5. Greets ---
sp3x
- --- 6.Contact ---
Author: Maksymilian Arciemowicz < cXIb8O3 >
Email: max [at] jestsuper [dot] pl or cxib [at] securityreason [dot] com
securityreason.com TEAM
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (FreeBSD)
iD8DBQFCVVpCznmvyJCR4zQRApbvAJ9Rw3j1RsIZ+UbFGfhnpfJteenUyQCfZI5M
aCv6WjmzYvJyvheHsluCfe0=
=vaqN
-----END PGP SIGNATURE-----