PHP-Nuke <= 8.0 Cookie Manipulation (lang)
/////////////////////////////////////////////////////////////////////////////////////////////////////
PHPNuke <= 8.0 Cookie Manipulation (lang)
PROGRAM: PHP-Nuke
HOMEPAGE: http://phpnuke.org/
VERSION: All version
BUG: Cookie Manipulation (lang) (SQL Injection + Local file include)
AUTHOR: Aleksandar aka sale83
///////////////////////////////////////////////////////////////////////////////////////////////////////
PHP.ini
Magic Quotes = OFF
//////////////////////////////////////////////////////////////////////////////////////////////////////
PHP-Nuke - >Preferences - > Multilingual Options-> On (Activate Multilingual
features? = YES)
/////////////////////////////////////////////////////////////////////////////////////////////////////
Bug is found in mainfile.php line 327.
// Line 327 Bug is here
} elseif (isset($lang)) {
include_once("language/lang-".$lang.".php"); // This can be exploited
by malicious users: ex: /../../robots.txt%00 Multilingual Options=OFF
$currentlang = $lang; // This can be exploited by malicious users.
ex:SQL Injection in Top and News Module ($currentlang) Multilingual Options = On
} else {
/////////////////////////////////////////////////////////////////////////////////////////////////
This flaw is due to an error when handling the "lang" cookie parameter, which
could be exploited by malicious users because $lang is not filtered.
Tested On:
Windows XP
Linux SlackWare 10.2
PHP Version 5.1.4
PHPNuke 8.0 ,7.9,7.6
Magic Quotes = OFF
Firefox 2 + Add N Edit Cookies Add-ons
/////////////////////////////////////////////////////////////////////////////////////////////////
Patch:
} elseif (isset($lang)) {
if (eregi('[A-Za-z]', $lang)) {
if (file_exists("language/lang-".$lang.".php")) {
include_once("language/lang-".$lang.".php");
$currentlang = $lang;
}else {
include_once("language/lang-english.php");
$currentlang = "english";
}
}else {
include_once("language/lang-english.php");
$currentlang = "english";
}
} else {
/////////////////////////////////////////////////////////////////////////////////////////////////
Best Regards
Aleksandar
Programmer and Web Developer
///////////////////////////////////////////////////////////////////////////////////////////////