How to patch your PhoenixPHP Injection Hole

[TomJacko95]

PhoenixPHP SQL Injection - YouTube

Watch the above video, which demonstrates how I got access to a database in a few simple steps.

HOW TO PATCH THIS
The exploit hole is very easy to fix!

Find:

<?php
			}
			
			elseif(isset($_GET["error"]) && $_GET["error"] == "ban")
			{
				if(isset($_GET["user"]))
				{

					$query = mysql_query("SELECT * FROM bans WHERE value = '".$_GET["user"]."' AND expire > UNIX_TIMESTAMP() ORDER BY expire DESC LIMIT 1");
				}
				else if(isset($_GET["ip"]))
				{

					$query = mysql_query("SELECT * FROM bans WHERE value = '".$_GET["ip"]."' AND expire > UNIX_TIMESTAMP() ORDER BY expire DESC LIMIT 1");
				}
				$ban = @mysql_fetch_array($query);
?>

and replace with

<?php
			}
			
			elseif(isset($_GET["error"]) && $_GET["error"] == "ban")
			{
				if(isset($_GET["user"]))
				{
					$_GET["user"] = mysql_real_escape_string($_GET["user"]);
					$query = mysql_query("SELECT * FROM bans WHERE value = '".$_GET["user"]."' AND expire > UNIX_TIMESTAMP() ORDER BY expire DESC LIMIT 1");
				}
				else if(isset($_GET["ip"]))
				{
					$_GET["ip"] = mysql_real_escape_string($_GET["ip"]);
					$query = mysql_query("SELECT * FROM bans WHERE value = '".$_GET["ip"]."' AND expire > UNIX_TIMESTAMP() ORDER BY expire DESC LIMIT 1");
				}
				$ban = @mysql_fetch_array($query);
?>

Simples :)

[MentaL]

[NoBrain]

Already been patched, by me.

http://forum.ragezone.com/f353/phoen...it-fix-784501/

[leenster]

I also posted a fix for this months ago... But good job anyways. And yes it is a serious exploit. I would recommend everybody that uses phoenix php or any edit of it to patch it as soon as possible.
Posted via Mobile Device

[Law]

<?php
            }
            
            elseif(isset($_GET["error"]) && $_GET["error"] == "ban")
            {
                if(isset($_GET["user"]))
                {
                    $_GET["user"] = mysql_real_escape_string($_GET["user"]);
                    $query = mysql_query("SELECT * FROM bans WHERE value = '".$_GET["user"]."' AND expire > UNIX_TIMESTAMP() ORDER BY expire DESC LIMIT 1");
                }
                else if(isset($_GET["ip"]))
                {
                    $_GET["ip"] = mysql_real_escape_string($_GET["ip"]);
                    $query = mysql_query("SELECT * FROM bans WHERE value = '".$_GET["ip"]."' AND expire > UNIX_TIMESTAMP() ORDER BY expire DESC LIMIT 1");
                }
                $ban = @mysql_fetch_array($query);
?>

Why do you make variables that doesn't even need to be there?....

<?php
            }
            
            elseif(isset($_GET["error"]) && $_GET["error"] == "ban")
            {
                if(isset($_GET["user"]))
                {
                    $query = mysql_query("SELECT * FROM bans WHERE value = '". mysql_real_escape_string($_GET["user"]) ."' AND expire > UNIX_TIMESTAMP() ORDER BY expire DESC LIMIT 1");
                }
                else if(isset($_GET["ip"]))
                {
                    $query = mysql_query("SELECT * FROM bans WHERE value = '". mysql_real_escape_string($_GET["ip"]) ."' AND expire > UNIX_TIMESTAMP() ORDER BY expire DESC LIMIT 1");
                }
                $ban = @mysql_fetch_array($query);
?>

Does the same thing as yours but you have created some variables that doesn't even need to be there?

[TomJacko95]

Already been patched, by me.

http://forum.ragezone.com/f353/phoen...it-fix-784501/

Ah that's my fault for not searching, my bad.

<?php
            }
            
            elseif(isset($_GET["error"]) && $_GET["error"] == "ban")
            {
                if(isset($_GET["user"]))
                {
                    $_GET["user"] = mysql_real_escape_string($_GET["user"]);
                    $query = mysql_query("SELECT * FROM bans WHERE value = '".$_GET["user"]."' AND expire > UNIX_TIMESTAMP() ORDER BY expire DESC LIMIT 1");
                }
                else if(isset($_GET["ip"]))
                {
                    $_GET["ip"] = mysql_real_escape_string($_GET["ip"]);
                    $query = mysql_query("SELECT * FROM bans WHERE value = '".$_GET["ip"]."' AND expire > UNIX_TIMESTAMP() ORDER BY expire DESC LIMIT 1");
                }
                $ban = @mysql_fetch_array($query);
?>

Why do you make variables that doesn't even need to be there?....

<?php
            }
            
            elseif(isset($_GET["error"]) && $_GET["error"] == "ban")
            {
                if(isset($_GET["user"]))
                {
                    $query = mysql_query("SELECT * FROM bans WHERE value = '". mysql_real_escape_string($_GET["user"]) ."' AND expire > UNIX_TIMESTAMP() ORDER BY expire DESC LIMIT 1");
                }
                else if(isset($_GET["ip"]))
                {
                    $query = mysql_query("SELECT * FROM bans WHERE value = '". mysql_real_escape_string($_GET["ip"]) ."' AND expire > UNIX_TIMESTAMP() ORDER BY expire DESC LIMIT 1");
                }
                $ban = @mysql_fetch_array($query);
?>

Does the same thing as yours but you have created some variables that doesn't even need to be there?

I haven't created them? The $_GET array is already set...

I also posted a fix for this months ago... But good job anyways. And yes it is a serious exploit. I would recommend everybody that uses phoenix php or any edit of it to patch it as soon as possible.
Posted via Mobile Device

As I said above yes, I didn't search :(

But yes serious stuff.

[Law]

Ah that's my fault for not searching, my bad.



I haven't created them? The $_GET array is already set...

$_GET["user"] = mysql_real_escape_string($_GET["user"]);                
                    
$_GET["ip"] = mysql_real_escape_string($_GET["ip"]); 

I mean those.

[TomJacko95]

$_GET["user"] = mysql_real_escape_string($_GET["user"]);                
                    
$_GET["ip"] = mysql_real_escape_string($_GET["ip"]); 

I mean those.

They are already part of the script, I haven't created them...

When you get banned it produces an error on the index page, using the GET variables it connects to the database.

In theory

x = secure(x)

I don't quite get what your trying to say...

[Law]

They are already part of the script, I haven't created them...

When you get banned it produces an error on the index page, using the GET variables it connects to the database.

In theory

x = secure(x)

I don't quite get what your trying to say...

<?php
/* 
Before you edited
$_GET["user"] = mysql_real_escape_string($_GET["user"]);
and
$_GET["ip"] = mysql_real_escape_string($_GET["ip"]);
is not here.
*/
            }
            
            elseif(isset($_GET["error"]) && $_GET["error"] == "ban")
            {
                if(isset($_GET["user"]))
                {

                    $query = mysql_query("SELECT * FROM bans WHERE value = '".$_GET["user"]."' AND expire > UNIX_TIMESTAMP() ORDER BY expire DESC LIMIT 1");
                }
                else if(isset($_GET["ip"]))
                {

                    $query = mysql_query("SELECT * FROM bans WHERE value = '".$_GET["ip"]."' AND expire > UNIX_TIMESTAMP() ORDER BY expire DESC LIMIT 1");
                }
                $ban = @mysql_fetch_array($query);
?>

and replace with

<?php
/* 
Your edited code has
$_GET["ip"] = mysql_real_escape_string($_GET["ip"]);
and
$_GET["ip"] = mysql_real_escape_string($_GET["ip"]);
*/
            }
            
            elseif(isset($_GET["error"]) && $_GET["error"] == "ban")
            {
                if(isset($_GET["user"]))
                {
                    $_GET["user"] = mysql_real_escape_string($_GET["user"]);
                    $query = mysql_query("SELECT * FROM bans WHERE value = '".$_GET["user"]."' AND expire > UNIX_TIMESTAMP() ORDER BY expire DESC LIMIT 1");
                }
                else if(isset($_GET["ip"]))
                {
                    $_GET["ip"] = mysql_real_escape_string($_GET["ip"]);
                    $query = mysql_query("SELECT * FROM bans WHERE value = '".$_GET["ip"]."' AND expire > UNIX_TIMESTAMP() ORDER BY expire DESC LIMIT 1");
                }
                $ban = @mysql_fetch_array($query);
?>

Simples :)

Read the text within the markings :/* */

Understand now?

[Hejula]

Lol'd PhoenixPHP comes with security in the core class.

public static function EscapeStringHK($string = '')
{
    return mysql_real_escape_string(stripslashes(trim($string)));
 } 

So you can just do

elseif(isset($_GET["error"]) && $_GET["error"] == "ban")
{
    if(isset($_GET["user"]))
    {
        $query = mysql_query("SELECT * FROM bans WHERE value = '".$core->EscapeStringHK($_GET["user"])."' AND expire > UNIX_TIMESTAMP() ORDER BY expire DESC LIMIT 1");
    }
    else if(isset($_GET["ip"]))
    {
        $query = mysql_query("SELECT * FROM bans WHERE value = '".$core->EscapeStringHK($_GET["ip"])."' AND expire > UNIX_TIMESTAMP() ORDER BY expire DESC LIMIT 1");
    }
    $ban = @mysql_fetch_array($query);
} 

[Fearhotel]

Maybe you should remove the Video due To N00bs Will start injecting.

[mohje]

password 2324fge523w34t code can also do havij lol >...<

Tut is nicee .

[TomJacko95]

Maybe you should remove the Video due To N00bs Will start injecting.

Fortunately, not many hotels are vulnerable to this kind of attack on the index page, and I'm sure noobs will be able to find any other injection holes.

[Nesar]

You turned this thread to hack tutorial thread....

[TomJacko95]

You turned this thread to hack tutorial thread....

It's not a hack tutorial, I don't give any instructions on how to go about this attack, details on what to use or how to use it.

The video explains pretty much nothing.

[Law]

Lol'd PhoenixPHP comes with security in the core class.

public static function EscapeStringHK($string = '')
{
    return mysql_real_escape_string(stripslashes(trim($string)));
 } 

So you can just do

elseif(isset($_GET["error"]) && $_GET["error"] == "ban")
{
    if(isset($_GET["user"]))
    {
        $query = mysql_query("SELECT * FROM bans WHERE value = '".$core->EscapeStringHK($_GET["user"])."' AND expire > UNIX_TIMESTAMP() ORDER BY expire DESC LIMIT 1");
    }
    else if(isset($_GET["ip"]))
    {
        $query = mysql_query("SELECT * FROM bans WHERE value = '".$core->EscapeStringHK($_GET["ip"])."' AND expire > UNIX_TIMESTAMP() ORDER BY expire DESC LIMIT 1");
    }
    $ban = @mysql_fetch_array($query);
} 

I don't use phoenixphp and I do not intend to use phoenixphp either. So I wouldn't have known of the function :)