Bugtraqmailing list archives

By Date

By Thread

Re: PHP Nuke <= 7.8 Multiple SQL Injections

I made some tests and seems to me that just environments wheremagic_quotes_gpc = 'Off' are affected (which is not default on php).When magic_quotes_gpc = On, the query that is sent to database isinterpreted as:SELECT active, view FROM nuke_modules WHERE title='\' OR 1=2 /*'Which is properly slashed. But, if we do have magic_quotes_gpc = Off,it's interpreted as:SELECT active, view FROM nuke_modules WHERE title='' OR 1=2 /*'Which is exploitable. On 9/15/05, Paul Laudanski <zx () castlecops com> wrote:

On Fri, 16 Sep 2005, Matthias Jim Knopf wrote:

What do you gain from that? In what way would you think your advice didANYTHING GOOD?You did neither issue a "addslashes()" as appropriate for SQL-commands,nor did you explain, why a variable set by a POST or a COOKIE could beworse than anything you could give any URL by appending '?name=...' or'&name=...' (->GET vars)

If you read the code and original advisory, there is filtering already inplace within the PHP-Nuke framework that monitors HTTP GETs.  As such,this 'exploit' makes of variables which should only be passed via HTTPGETs and not POSTs nor cookies.Proper data sanitization for this is simply to retrieve what is expected:$name = $_GET['name'];The function you specify likehttp://php.net/addslashes is neither herenor there.  Why use that function for a variable in POST or cookies whenit is clearly expected to be returned via GET alone?Ergo:register_globals off !--Paul Laudanski, Microsoft MVP Windows-SecurityCastleCops(SM),http://castlecops.com________ Information from Computer Cops, L.L.C. ________This message was checked by NOD32 Antivirus System for Linux Mail Server. part000.txt - is OKhttp://castlecops.com

-- # (perl -e "while (1) { print "\x90"; }") | dd of=/dev/evil

By Date

By Thread

Current thread:

• PHP Nuke <= 7.8 Multiple SQL Injectionsr . verton (Sep 12)
  • Re: PHP Nuke <= 7.8 Multiple SQL InjectionsPaul Laudanski (Sep 15)
    • Re: PHP Nuke <= 7.8 Multiple SQL InjectionsMatthias Jim Knopf (Sep 16)
      • Re: PHP Nuke <= 7.8 Multiple SQL InjectionsPaul Laudanski (Sep 16)
      • Re: PHP Nuke <= 7.8 Multiple SQL InjectionsDaniel Bonekeeper (Sep 19)
      • Re: PHP Nuke <= 7.8 Multiple SQL InjectionsPaul Laudanski (Sep 19)
      • Re: PHP Nuke <= 7.8 Multiple SQL Injectionshans (Sep 19)
  • <Possible follow-ups>
  • Re: PHP Nuke <= 7.8 Multiple SQL Injectionsevaders99 (Sep 15)
    • Re: PHP Nuke <= 7.8 Multiple SQL InjectionsPaul Laudanski (Sep 16)