NexusPHP is a resource-sharing CMS used for P2P downloading; the source code download link is https://github.com/ZJUT/NexusPHP

Preliminary Analysis

[

](https://github.com/ZJUT/NexusPHP)

This CMS has a global SQL-injection filtering function, sqlesc()

nexusphp/include/globalfunctions.php #75

  1. Global filtering: SQL injection prevention #1. It escapes input with the MySQL anti-injection function and wraps the statement in single quotes, which makes it impossible to inject quotes or introduce variables ($ inside single quotes is not interpreted as a variable)

  2. Global filtering: SQL injection prevention #2. Integer casts are used frequently, forcibly converting values to numbers via addition

  1. Improper validation in the getip() function allows IP spoofing. First, the IP-retrieval function is written like this:
<?php
function getip() {
	if (isset($_SERVER)) {
		if (isset($_SERVER['HTTP_X_FORWARDED_FOR']) && validip($_SERVER['HTTP_X_FORWARDED_FOR'])) {
			$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
		} elseif (isset($_SERVER['HTTP_CLIENT_IP']) && validip(......
                                                           ...
?>
  • It takes the X_FORWARDED_FOR request header as the IP address — and this header is spoofable!
  • Second, the logic in the validation function validip() overgeneralizes: it assumes that anything making ip2long() fail must be an IPv6 address…

  • In reality: any string that is not an IP makes it return False, meaning this point is fully controllable — lovely.

Enough said, let’s start the audit.

0x01 Controllable email content in the front-end password recovery flow, leading to stored XSS

Following up on the IP-spoofing issue in the getip() function, let’s look for places that reference it

We find recover.php, which contains a password recovery feature

heredoc

PHP EOF (heredoc) usage notes: PHP EOF (heredoc) is a way of defining a string in command-line shells (such as sh, csh, ksh, bash, PowerShell, and zsh) and programming languages (like Perl, PHP, Python, and Ruby).

Add a snippet that prints the body, capture the request, modify the XFF header, and add an XSS payload

Simulating the scenario of receiving the message in an email client — it’s the familiar XSS

0x02 SQL injection in nowarn.php

Requires being logged in and not being a regular user

Starting at line 36 of nowarn.php, user input is concatenated directly into the SQL statement

# payload for reference only
(select*from(select sleep(10))x)#

The only catch is that this injection point requires authentication

0x03 SQL injection in linksmanage.php

As shown in the figure, the key logic passes user variables straight in — it doesn’t even use the sqlesc filtering function…

There are several other SQL injection points as well, all discoverable with regular expressions; you can refer to its CVE site — no need to repeat them here.

0x04 Malicious SQL query risk

In moforums.php, there is a query like the following

sql_query("UPDATE overforums SET sort = " . sqlesc($_POST['sort']) . ", name = " . sqlesc($_POST['name']). ", description = " . sqlesc($_POST['desc']). ", minclassview = " . sqlesc($_POST['viewclass']) . " WHERE id = ".sqlesc($_POST['id'])) or sqlerr(__FILE__, __LINE__);

One could consider using /* */ to comment out the middle portion, achieving the effect of executing a malicious statement… though it’s only a risk, nothing more…

Other risk points

iconv truncation

Low versions: (by default) totally exploitable

High versions: (conditionally) totally exploitable

Let’s look at the official PHP documentation to see what it says about the iconv function

In PHP < 5.4.0, illegal characters cause truncation, returning only the content that could be decoded normally before the illegal string

In PHP >= 5.4.0, illegal characters cause an error and a return value of False, unless //IGNORE is appended to the output string — which is exactly the case in this CMS

In other words, we can control the output and use this behavior to bypass checks such as file-extension validation

Summary

  1. Auditing this CMS, many spots turned out to be concatenations like the 0x02 injection, but they all require high privileges to reach the vulnerable code and inject, so they are of little value.
  2. The vast majority of parameters undergo forced type casting, and there are no common command-execution functions
  3. You can refer to these folks’ CVEs and CNNVD — in 2017 a wave of mass-harvested bugs was reported, mainly XSS and SQL injection; repetitive work, rather dull
  4. Building on predecessors’ work, this audit discovered the neat trick of using comments to reduce the number of queried columns in multi-parameter SQL cases — quite a few new techniques learned.