Exploit-DB #5292
Description: PostNuke 0.764 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-03-21
Author: The:Paradox

Exploit:
#!/usr/bin/python
#=================================================================================================# 
#                     ____            __________         __             ____  __                  #
#                    /_   | ____     |__\_____  \  _____/  |_          /_   |/  |_                #
#                     |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\               #
#                     |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |                 #
#                     |___|___|  /\__|  /______  /\___  >__|            |___||__|                 #
#                              \/\______|      \/     \/                                          #
#=================================================================================================#
#                                     This was a priv8 Exploit                                    #
#=================================================================================================#
#  	           		         Postnuke <= 0.764                                        #
#                                 Blind Sql Injection Vulnerability                               #
#                                         Benchmark Method                                        #
#                                                                                                 #
#                                       Vendor:   www.postnuke.com	                          #
#                                     Severity:   High                                            #
#                                       Author:   The:Paradox                                     #
#=================================================================================================# 
#                                       Proud To Be Italian.                                      #
#====================================#============================================================#
# Proof Of Concept / Bug Explanation #                                                            #  
#====================================#                                                            #     
# Postnuke presents a critical vulnerability in pnVarPrepForStore() function. Let's see source:   #                                                                                               
#                                                                                                 #
#                                                                                                 #
#	1. function pnVarPrepForStore()                                                           #
#	2. {                                                                                      #
#	3.     $resarray = array();                                                               #
#	4.     foreach (func_get_args() as $ourvar) {                                             #
#	5.         if (!get_magic_quotes_runtime() && !is_array($ourvar)) {                       #
#	6.             $ourvar = addslashes($ourvar);                                             #
#	7.        	}                                                                         #
#	8.         // Add to array                                                                #
#	9.         array_push($resarray, $ourvar);                                                #
#	10.     }                                                                                 #
#	11.     // Return vars                                                                    #
#	12.     if (func_num_args() == 1) {                                                       #
#	13.         return $resarray[0];                                                          #
#	14.     } else {                                                                          #
#	15.         return $resarray;                                                             #
#	16.     }                                                                                 #
#	17. }                                                                                     #              
#                                                                                                 #     
# This function is used to prepare vars for sql queries. It "add slashes" to given variables.     #
# But wat happens if get_magic_quotes_runtime() is On in Server Configuration?                    # 
# The script does nothing 'cause variables should be already cleaned.                             #
#                                                                                                 #
# Whatever the script author didn't thought about Server Variables: they are untouched by         #
# magic_quotes_gpc and magic_quotes_runtime().                                                    #                                               
# Therefore all Server Variables are not propelly checked with magic_quotes_runtime() On          #
#                                                                                                 #
# In this exploit I will inject Sql code in HTTP_CLIENT_IP header, see pnSessionInit() function.  #
#=================================================================================================#
# Use this at your own risk. You are responsible for your own deeds.                              #
#=================================================================================================#				          
"""                                                                                                
                                            Related Codes:
function pnSessionInit()
{
    $dbconn =& pnDBGetConn(true);
    $pntable =& pnDBGetTables();
    // First thing we do is ensure that there is no attempted pollution
    // of the session namespace