$lang vulnerability in mainfile.php

Gremmie · Posted: Tue Mar 13, 2007 6:42 pm

My days are numbered with PHP-Nuke 7.9, but I thought I would pass this along.

Regarding

Only registered users can see links on this board!
Get registered or login to the forums!

....

I am running 7.9 with the 3.2 patches. My site only runs English, no multi-lingual options, so I sledge-hammered a fix for this exploit.

I went in to mainfile.php and found this code:

Code:

if (!defined('FORUM_ADMIN')) {
if ((isset($newlang)) AND (stristr($newlang,"."))) {
if (file_exists("language/lang-".$newlang.".php")) {
setcookie("lang",$newlang,time()+31536000);
include_once("language/lang-".$newlang.".php");
$currentlang = $newlang;
} else {
setcookie("lang",$language,time()+31536000);
include_once("language/lang-".$language.".php");
$currentlang = $language;
}
} elseif (isset($lang)) {
include_once("language/lang-".$lang.".php");
$currentlang = $lang;
} else {
setcookie("lang",$language,time()+31536000);
include_once("language/lang-".$language.".php");
$currentlang = $language;
}
}

and changed it to this:

Code:

$currentlang = 'english';
if (!defined('FORUM_ADMIN')) {
include_once('language/lang-'.$language.'.php');
$currentlang = $language;
}

Comments?

evaders99 · Posted: Tue Mar 13, 2007 9:38 pm

Well that would disable the multi-language features completely. The full code the Patched files use is

Code:

if (!defined('FORUM_ADMIN')) {
if (($multilingual == 1) AND isset($newlang) AND !stristr($newlang,".")) {
   $newlang = check_html($newlang, "nohtml");
   if (file_exists("language/lang-".$newlang.".php")) {
      setcookie("lang",$newlang,time()+31536000);
      include_once("language/lang-".$newlang.".php");
      $currentlang = $newlang;
   } else {
      setcookie("lang",$language,time()+31536000);
      include_once("language/lang-".$language.".php");
      $currentlang = $language;
   }
} elseif (($multilingual == 1) AND isset($lang) AND !stristr($lang,".")) {
   $lang = check_html($lang, "nohtml");
   if (file_exists("language/lang-".$lang.".php")) {
      setcookie("lang",$lang,time()+31536000);
      include_once("language/lang-".$lang.".php");
      $currentlang = $lang;
   } else {
      setcookie("lang",$language,time()+31536000);
      include_once("language/lang-".$language.".php");
      $currentlang = $language;
   }
} else {
   setcookie("lang",$language,time()+31536000);
   include_once("language/lang-".$language.".php");
   $currentlang = $language;
}
}

Gremmie · Posted: Wed Mar 14, 2007 6:50 am

Thanks for posting the full code. Mine was admittedly a quick hack not intended for general use.

I gather that the block that lets you switch languages is the thing that actually sets $newlang (in a _POST or _GET)?

evaders99 · Posted: Wed Mar 14, 2007 5:44 pm

I believe it should. At least its working in 7.8 Patched and lower