https://cxsecurity.com/issue/WLB-2005090041

漏洞细节尚未披露

[phpnuke 7.6 Multiple vulnerabilities in Web_Links Module cXIb8O3.14]

Author: Maksymilian Arciemowicz (cXIb8O3)
Date: 6.4.2005
from cxsecurity.com TEAM

- --- 0.Description ---
PHP-Nuke is a Web Portal System, storytelling software, news system, online community or whatever you want to call it.
Its goal is to have an automated web site to distribute news and articles with user system. Each user can submit
comments to discuss the articles, similar to Slashdot and many others. Features: web admin, polls/surveys with comment,
statistics, user customizable box, themes manager, friendly admin GUI, moderation system, sections manager, banner
system, backend/headlines generation, Yahoo like search engine, Ephemerids manager, file manager, download manager, faq
manager, advanced blocks system, reviews system, newsletter, content management, encyclopedia generator, md5 password
encryption, phpBB Forums integration, support for 25 languages, 100% modular and more. Written 100% in PHP and requires
Apache, PHP and a SQL Database Server. Supports MySQL, PostgreSQL, Adabas, mSQL and many others.

- --- 1. Sql Injection ---
1.0
Sql Injection exist in function Add().

- --- line 273-280 ---
$title = stripslashes(check_html($title, "nohtml"));
$url = stripslashes($url);
$description = stripslashes($description);
$auth_name = stripslashes($auth_name);
$email = stripslashes($email);
$cat[0] = intval($cat[0]);
$cat[1] = intval($cat[1]);
$db->sql_query("insert into ".$prefix."_links_newlink values (NULL, '$cat[0]', '$cat[1]',
'$title', '$url', '$description', '$auth_name', '$email', '$submitter')");
- --- line 273-280 ---

Varible $email, $url etc.
But this sql injection is in the INSERT. So url is.

http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=Add&title=cXIb8O3&url=I&description=Spex&email='
,[SQL]

But why dosen't exist error? Because that is blind sql injection and can not see errors.

so sql query is:

- ---
insert into nuke_links_newlink values (NULL, '0', '0', 'cXIb8O3', 'I', 'Spex', '', '',[SQL]', 'Admin')
- ---

1.1
Sql Injection exist in function modifylinkrequestS().

- --- line 1849-1855 ---
$title = stripslashes(check_html($title, "nohtml"));
$url = stripslashes($url);
$description = stripslashes($description);
$lid = intval($lid);
$cat[0] = intval($cat[0]);
$cat[1] = intval($cat[1]);
$db->sql_query("insert into ".$prefix."_links_modrequest values (NULL, '$lid', '$cat[0]',
'$cat[1]', '$title', '$url', '$description', '$ratinguser', 0)");
- --- line 1849-1855 ---

And varible $email, $url etc.
This is Blind Sql Injection.
So url is:

http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=modifylinkrequestS&url='[SQL]

sql query:

- ---
insert into nuke_links_modrequest values (NULL, '0', '0', '0', '', ''[SQL]', '', 'Admin', 0)
- ---

1.2
This SQL Injection is non critical and blind. Insert in viewlink() function.


655# if (!isset($min)) $min=0;
..
728# $result4 = $db->sql_query("SELECT lid, title, description, date, hits, linkratingsummary, totalvotes,
totalcomments from ".$prefix."_links_links where cid='$cid' order by $orderby limit $min,$perpage");


and url is

http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=viewlink&orderby=[SQL]&min=[SQL]

so sql query is:

- ---
SELECT lid, title, description, date, hits, linkratingsummary, totalvotes, totalcomments from nuke_links_links where
cid='0' order by [SQL] limit [SQL],10
- ---

and check 3. Errors in functions

1.3
This SQL Injection is non critical and blind. Insert in search() function.

- --- line 942-956 ---
if (!isset($min)) $min=0;
if (!isset($max)) $max=$min+$linksresults;
if(isset($orderby)) {
$orderby = convertorderbyin($orderby);
} else {
$orderby = "title ASC";
}
if ($show!="") {
$linksresults = $show;
} else {
$show=$linksresults;
}
$query = check_html($query, nohtml);
$query = addslashes($query);
$result = $db->sql_query("SELECT lid, cid, sid, title, url, description, date, hits, linkratingsummary,
totalvotes, totalcomments from ".$prefix."_links_links where title LIKE '%$query%' OR description LIKE
'%$query%' ORDER BY $orderby LIMIT $min,$linksresults");
- --- line 942-956 ---

Varible $min, $show, $orderby.

http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=search&query=sex&orderby=[SQL]&min=[SQL]&show=[S
QL]

And SQL Query is

- ---
SELECT lid, cid, sid, title, url, description, date, hits, linkratingsummary, totalvotes, totalcomments from
nuke_links_links where title LIKE '%sex%' OR description LIKE '%sex%' ORDER BY [SQL] LIMIT [SQL],[SQL]
- ---
and check 3. Errors in functions


1.4
This SQL Injection is non critical and blind. Insert in MostPopular() function.

558# $result3 = $db->sql_query("SELECT lid, cid, sid, title, description, date, hits, linkratingsummary,
totalvotes, totalcomments from ".$prefix."_links_links order by hits DESC limit 0,$mostpoplinks");

Varible $mostpoplinks.

http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=MostPopular&ratenum=[SQL]&ratetype=num

and sql query is:

- ---
SELECT lid, cid, sid, title, description, date, hits, linkratingsummary, totalvotes, totalcomments from nuke_links_links
order by hits DESC limit 0,[SQL]
- ---

- --- 2. Path Disclousure ---
2.0
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=search&query=Hihihi&show=cXIb8O3

Error message :
- ---------------
Warning: Division by zero in /www/phpnuke/76/html/modules/Web_Links/index.php on line 1050
- ---------------

- --- 3. Errors in functions ---
Errors exists in functions convertorderbyin(), convertorderbytrans(), convertorderbyout().
For example convertorderbyin():

- ---
function convertorderbyin($orderby) {
if ($orderby == "titleA") $orderby = "title ASC";
if ($orderby == "dateA") $orderby = "date ASC";
if ($orderby == "hitsA") $orderby = "hits ASC";
if ($orderby == "ratingA") $orderby = "linkratingsummary ASC";
if ($orderby == "titleD") $orderby = "title DESC";
if ($orderby == "dateD") $orderby = "date DESC";
if ($orderby == "hitsD") $orderby = "hits DESC";
if ($orderby == "ratingD") $orderby = "linkratingsummary DESC";
return $orderby;
}
- ---

but if orderby=cXIb8O3? Convert don't work.

- --- 4. Fix ---
AD 1.0
Change

- ---
$db->sql_query("insert into ".$prefix."_links_newlink values (NULL, '$cat[0]', '$cat[1]',
'$title', '$url', '$description', '$auth_name', '$email', '$submitter')");
- ---

to

- ---
$db->sql_query("insert into ".$prefix."_links_newlink values (NULL, '$cat[0]', '$cat[1]',
'".addslashes($title)."', '".addslashes($url)."', '".addslashes($description)."',
'".addslashes($auth_name)."', '".addslashes($email).",
'".addslashes($submitter)."')");
- ---

AD 1.1
Change

- ---
$db->sql_query("insert into ".$prefix."_links_modrequest values (NULL, '$lid', '$cat[0]', '$cat[1]',
'$title', '$url', '$description', '$ratinguser', 0)");
- ---

to

- ---
echo "insert into ".$prefix."_links_modrequest values (NULL, '$lid', '$cat[0]', '$cat[1]',
'".addslashes($title)."', '".addslashes($url)."', '".addslashes($description)."',
'".addslashes($ratinguser)."', 0)";
- ---

AD 1.2
Change

- ---
$result4 = $db->sql_query("SELECT lid, title, description, date, hits, linkratingsummary, totalvotes,
totalcomments from ".$prefix."_links_links where cid='$cid' order by $orderby limit $min,$perpage");
- ---

to

- ---
if(!is_numeric($min)){
$min=0;
}
$result4 = $db->sql_query("SELECT lid, title, description, date, hits, linkratingsummary, totalvotes,
totalcomments from ".$prefix."_links_links where cid='$cid' order by $orderby limit $min,$perpage");
- ---


AD 1.3
Change

- ---
$result = $db->sql_query("SELECT lid, cid, sid, title, url, description, date, hits, linkratingsummary,
totalvotes, totalcomments from ".$prefix."_links_links where title LIKE '%$query%' OR description LIKE
'%$query%' ORDER BY $orderby LIMIT $min,$linksresults");
- ---

to

- ---
if(!is_numeric($linksresults) AND $linksresults==0)
{
$linksresults=10;
}
$result = $db->sql_query("SELECT lid, cid, sid, title, url, description, date, hits, linkratingsummary,
totalvotes, totalcomments from ".$prefix."_links_links where title LIKE '%$query%' OR description LIKE
'%$query%' ORDER BY $orderby LIMIT ".intval($min).",$linksresults");
- ---

AD 1.4
Change

- ---
$result3 = $db->sql_query("SELECT lid, cid, sid, title, description, date, hits, linkratingsummary, totalvotes,
totalcomments from ".$prefix."_links_links order by hits DESC limit 0,$mostpoplinks");
- ---

to

- ---
if(!is_numeric($mostpoplinks)) {
$mostpoplinks=10;
}
$result3 = $db->sql_query("SELECT lid, cid, sid, title, description, date, hits, linkratingsummary,
totalvotes, totalcomments from ".$prefix."_links_links order by hits DESC limit 0,$mostpoplinks");
- ---

AD 3.0
Change function convertorderbyin()
to

- ---
function convertorderbyin($orderby) {
if ($orderby != "titleA" AND $orderby != "dateA" AND $orderby != "hitsA" AND $orderby !=
"ratingA" AND $orderby != "titleD" AND $orderby != "dateD" AND $orderby !=
"hitsD" AND $orderby != "ratingD") {
$orderby = "title ASC";
}
if ($orderby == "titleA") $orderby = "title ASC";
if ($orderby == "dateA") $orderby = "date ASC";
if ($orderby == "hitsA") $orderby = "hits ASC";
if ($orderby == "ratingA") $orderby = "linkratingsummary ASC";
if ($orderby == "titleD") $orderby = "title DESC";
if ($orderby == "dateD") $orderby = "date DESC";
if ($orderby == "hitsD") $orderby = "hits DESC";
if ($orderby == "ratingD") $orderby = "linkratingsummary DESC";
return $orderby;

}
- ---

Change function convertorderbytrans()
to

- ---
function convertorderbytrans($orderby) {
if ($orderby != "hits ASC" AND $orderby != "hits DESC" AND $orderby != "title ASC" AND
$orderby != "title DESC" AND $orderby != "date ASC" AND $orderby != "date DESC" AND
$orderby != "linkratingsummary ASC" AND $orderby != "linkratingsummary DESC") {
$orderbyTrans = ""._POPULARITY1."";
}
if ($orderby == "hits ASC") $orderbyTrans = ""._POPULARITY1."";
if ($orderby == "hits DESC") $orderbyTrans = ""._POPULARITY2."";
if ($orderby == "title ASC") $orderbyTrans = ""._TITLEAZ."";
if ($orderby == "title DESC") $orderbyTrans = ""._TITLEZA."";
if ($orderby == "date ASC") $orderbyTrans = ""._DATE1."";
if ($orderby == "date DESC") $orderbyTrans = ""._DATE2."";
if ($orderby == "linkratingsummary ASC") $orderbyTrans = ""._RATING1."";
if ($orderby == "linkratingsummary DESC") $orderbyTrans = ""._RATING2."";
return $orderbyTrans;
}
- ---

Change function convertorderbyout()
to

- ---
function convertorderbyout($orderby) {
if ($orderby != "hits ASC" AND $orderby != "hits DESC" AND $orderby != "title ASC" AND
$orderby != "title DESC" AND $orderby != "date ASC" AND $orderby != "date DESC" AND
$orderby != "linkratingsummary ASC" AND $orderby != "linkratingsummary DESC") {
$orderby = "titleA";
}
if ($orderby == "title ASC") $orderby = "titleA";
if ($orderby == "date ASC") $orderby = "dateA";
if ($orderby == "hits ASC") $orderby = "hitsA";
if ($orderby == "linkratingsummary ASC") $orderby = "ratingA";
if ($orderby == "title DESC") $orderby = "titleD";
if ($orderby == "date DESC") $orderby = "dateD";
if ($orderby == "hits DESC") $orderby = "hitsD";
if ($orderby == "linkratingsummary DESC") $orderby = "ratingD";
return $orderby;
}
- ---

- --- 5. Greets ---



- --- 6.Contact ---
Author: Maksymilian Arciemowicz < cXIb8O3 >