Home page logo

fulldisclosure logo Full Disclosure mailing list archives

[waraxe-2004-SA#035 - Multiple security holes in PhpNuke - part 2]
From: Janek Vind <come2waraxe () yahoo com>
Date: Fri, 16 Jul 2004 15:14:51 -0700 (PDT)

{                              [waraxe-2004-SA#035]   
{                 [ Multiple security holes in PhpNuke
- part 2]                 }
Author: Janek Vind "waraxe"
Date: 17. July 2004
Location: Estonia, Tartu
Web: http://www.waraxe.us/index.php?modname=sa&id=35

Affected software description:

Php-Nuke is a popular freeware content management
system, written in php by
Francisco Burzi. This CMS (Content Management System)
is used on many thousands
websites, because it's freeware, easy to install and
has broad set of features.

Homepage: http://phpnuke.org


This time we will look @ security holes - 1 XSS and 1
sql inject case -  
in "Search" module.

A - Cross-site scripting aka XSS

A1 - xss in "/modules/Search/index.php":

Open search page in phpnuke:


and enter to input field something like this:

1"><body onload="alert(document.cookie);

In case of other browsers than IE xss exploiting
method can be modified, but one thing
is sure - xss case exists here...

B - Sql Injection

B1 - critical sql injection case in

Well, let's look at source code from that script:

----------------[ original source ]-----------------
} elseif ($type == "comments" AND isset($sid)) {
        $res = $db->sql_query("select title from
".$prefix."_stories where sid='$sid'");
        list($st_title) = $db->sql_fetchrow($res);
        $instory = "AND sid='$sid'";
        echo "<center><font
} else {
        echo "<center><font class=\"title\"><b>"._SEARCHIN."
----------------[/original source ]-----------------

So - if search type is "comments" and there is no
"sid" specified, then sql query 
fragment "instory" is not initialized. Now, let's look

----------------[ original source ]-----------------
} elseif ($type=="comments") {
        $result8 = $db->sql_query("SELECT tid, sid, subject,
date, name from
         ".$prefix."_comments where (subject like '%$query%'
OR comment like '%$query%')
         $instory order by date DESC limit $min,$offset");
----------------[/original source ]-----------------

What is here, is a typical case of uninitialized
variable - "instory".
It's time to turn this little bug to something evil:

----------------[ real life exploit ]---------------


----------------[/real life exploit ]---------------

... and we see all the secret information about admins

Have a nice day!

How to fix:

Fixing tutorials, discussion, help - look at

See ya there!


Greets to Raido Kerna and to
http://www.gamecheaters.us staff!
Special greets to icenix and slimjim100!
Tervitused - Heintz ja Maku!


    come2waraxe () yahoo com
    Janek Vind "waraxe"

    Homepage: http://www.waraxe.us/

---------------------------------- [ EOF ]

Do you Yahoo!?
Vote for the stars of Yahoo!'s next ad campaign!

Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
  • [waraxe-2004-SA#035 - Multiple security holes in PhpNuke - part 2] Janek Vind (Jul 17)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]