Phpnuke Vulnerability

GovernmentSecurity.org > The Archives > Exploit Articles

liquidSilver

Mar 17 2004, 01:13 PM

QUOTE

[waraxe-2004-SA#005]

Author: Janek Vind "waraxe"
Date: 15. March 2004
Location: Estonia, Tartu

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Php-Nuke is popular freeware content management system, written in php by Francisco Burzi. This CMS (COntent Management System) is used on many thousands websites, because it`s free of charge, easy to install and has broad set of features.

Homepage: http://phpnuke.org

Vulnerabilities:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Through the history of the PhpNuke there has been lots of messages and announcments about the Cross-Site Scripting aka XSS problems in this popular content management system. Now PhpNuke has allready version number 7.1.0, but still we can't say, that it's secure software. This advisory - "waraxe-2004-SA#005" - is meant to uncover some more XSS cases, besides those published earlier by me in "waraxe-2004-SA#002". So, let's begin...

1. http://localhost/nuke71/modules.php?name=Feedback

If we use in "Your Name" field the string:

"><body onload=alert(document.cookie);>

then we have XSS conditions. Same applies to email field.

2. http://localhost/nuke71/modules.php?name=Y...nt&op=pass_lost

In "nicname" field we use "><body onload=alert(document.cookie);> and XSS is available.

Remark - you need to make custom form, because in the original html code there is limited length of the "nicname" text field - 15 symbols.

3. http://localhost/nuke71/modules.php?name=R...Sent&fname=>[xss code here]

Remark - because the GET parameters are filtered in PhpNuke, we need to bukd custom html code with proper form and then use POST parameters to complete the mission. By the way - even COOKIE parameters can be used for this and it`s really handy, because COOKIE stuff get's rarely logged by web server software. This applies to all XSS cases in PhpNuke, because the use of the code "import_request_variables('GPC');" in the mainfile.php

4. http://localhost/nuke71/modules.php?name=D...ed&ratenum=>[xss code here]&ratetype=x

5. http://localhost/nuke71/modules.php?name=J...disp=showsearch

We can exploit the search field for implement the XSS.

Finally - if we use XSS, we can steal cookies, use them to pretend to be somebody else (authentication bypass), and if the victim of the impersonating has admin rights in PhpNUke, then the entire website is allready compromised...

Greetings:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Greets to ulljobu, djzone, raider and to all IT freaks in Estonia!

Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

come2waraxe@yahoo.com
Janek Vind "waraxe"

migo

Mar 17 2004, 03:04 PM

hey guys
i wonder if anyone could explained some sort of XSS code that could be injected and what is the effect of injecting such a code

i don't have previous xss experince so any info is appreciated

Best Regards
migo

D3ADLiN3

Mar 17 2004, 03:25 PM

ok this maybe some help:

http://www.safecenter.net/UMBRELLAWEBV4/genxe/index.html

XSS Creator/info

migo

Mar 18 2004, 02:58 PM

awesome dude
thnx very much

))

Mandarins

Mar 18 2004, 08:52 PM

good one thankx

mike

Mar 18 2004, 09:51 PM

phpnuke has been continuously having security problems :/ i would suggest not using it at all.

extreme

Mar 18 2004, 10:03 PM

Yes, it have some really tuff problems. Even Muts from secureit.co.il stopped using it now...
And as for this exploit, it is not working very well. Haven't tryed many mashines, but still..

aapje

Mar 18 2004, 10:20 PM

on a lot of nuke systems the old exploit still works, on the download page to view all the admin hashes

Nexus1155

Mar 19 2004, 03:22 AM

I never knew how to do injection nor i ever will....

jockel

Mar 19 2004, 02:06 PM

really nice, works fine thx =)
phpnuke hast lots of unxifed holes ....

setthesun

Mar 19 2004, 04:34 PM

There are lots of dangerous SQL Injections in phpnuke, also several XSS flaws.

And I'm sure one of them will fit your victim

And it's a very bad idea to use PHPNuke every versionn have lots of security flaws.

extreme

Mar 19 2004, 05:32 PM

Any way to find out what version it is? Like check if some module that exist in new version only???

tweakz20

Mar 20 2004, 03:56 AM

i love checking up on the newest php flaws (sure are a lot)... they're pretty neat

migo

Mar 20 2004, 12:47 PM

yes yes
phpnuke is ful of bugs
for me i tried SQL injection in some sites and it works!!!!! even the authors and some other release patches one after one but this software is continuing to be Vulnerable!!!

till now i can' figure out how XSS exlpoit could be used
but i hope anyone who have more exerince in it to share this with us

Best Regards
migo

migo

Mar 20 2004, 01:28 PM

here is a site that contains a good info regarding XSS
http://www.cgisecurity.com/articles/xss-faq.shtml

i begin t get the big picture but still want a working example in phpnuke

Best Regards
migo

aapje

Mar 20 2004, 01:43 PM

thanks for the info i'll try it

wizy

Mar 21 2004, 11:38 AM

Any good working examples yet, of say "change my account to admin"?

migo

Mar 21 2004, 01:47 PM

my favourite thing to play with in phpnuke is the sql injection
in many sites even the following POC released since 2 february, but the sql injection bug is still existed among many popular nuke sites
this script is full of security flaws and i join anyone who says stop using PHPnuke
it's NOT SECURE at all.

simple exploits using sql injection is....

http://www.net-security.org/vuln.php?id=3226

u will find a copmerhensive details about the bugs in WebLink,Downloads,Sections and Reviews modules in phpnuke

u can use either of the exploit provided for getting all admin hashes and their login names too

simply after u get the md5 hash and the login name
example (login name= news) (md5 hash= 21232f297a57a5a743894a0e4a801fc3 )

u can use any sites that offer base64 encode-decode like

http://www.isecurelabs.com/outils/base64/

and then put the login name and md5 password to encode them

news:21232f297a57a5a743894a0e4a801fc3

the resulting base64 encryption for the above login and md5 will be :

bmV3czoyMTIzMmYyOTdhNTdhNWE3NDM4OTRhMGU0YTgwMWZjMw

now you can get this wonderful script to add the admin account of YOUR OWN!!!
just save the following link anything.pl

http://rst.void.ru/download/r57nuke.txt

use any perl interpreter to run this script,
the script will ask u about the website u wan to break to and enter ur nuick and ur password and last is to enter the base64 encoded string that u get in the the above explanation.

it's pretty easy and simple process and i'll appreciate any good example of making XSS exploits

hope that help

Best Regards
migo

z0mbi3

Mar 21 2004, 09:09 PM

to convert to base64

http://makcoder.sourceforge.net/demo/base64.php

[edit]sry didn't see that base64 convertor up ther..my fault..

aapje

Mar 22 2004, 08:56 PM

i now know about xss, but still, can someone give an example how to use it in the feedback module? I try "><body onload=alert(document.cookie);> and get my own coockie, but how to get them from others

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.